Your staff are already using AI. You just cannot see it.

Ask a room of SME owners whether their staff use AI tools at work and about half say no. Ask the staff and the number is far higher. The gap is not dishonesty — it is that nobody asked, so nobody mentioned it.

This is shadow AI, and pretending it is not happening is the one strategy guaranteed to fail.

What is actually being pasted

Not usually anything dramatic. A customer's email, to draft a reply. A chunk of a contract, to check what a clause means. A spreadsheet of sales figures, to summarise. A specification, to turn into a quote.

Individually, each feels harmless. Collectively, your commercial terms, customer list and pricing have left the building through a browser tab, and you have no record of it.

Why banning it fails

Three reasons, and they apply to every firm regardless of size.

It is unenforceable — the tools are free and reachable from a phone. It punishes the people who told you, and rewards the ones who did not. And it puts you at a disadvantage against competitors whose staff are doing it anyway, just with permission.

A ban converts a manageable risk into an invisible one.

The one-page policy

Length is the point. A twelve-page policy is not read; a one-pager on the wall is.

Name the approved tools. Pick one or two and pay for the business tier. Paid business accounts generally do not train on your data, where free consumer accounts may — that single change removes most of the risk for a modest monthly cost.

List what never goes in, in plain language. Not "confidential information" — say it concretely: customer drawings and specifications, anything under NDA, personal data about staff or customers, pricing and margin, anything with a password or key in it.

Say what the tools may be used for. Drafting, summarising, explaining, rewriting, code you will review. Being permissive here is what earns you compliance on the previous point.

Require a human check on anything leaving the business. One line, applied without exception.

Name someone to ask. If there is no obvious person, people guess — and they guess in the permissive direction.

The client-confidentiality trap

Worth singling out, because it catches engineering firms specifically. If you have signed an NDA with a customer, pasting their drawing into a public AI tool may breach it. Many customer agreements now include explicit AI clauses, and the ones that do not still have confidentiality clauses broad enough to cover it.

This is not theoretical. It is the kind of thing that surfaces in a supplier audit, and the answer "we did not realise" is not a good one to give a tier-one customer.

What to do this month

Ask people what they already use, without consequence — you cannot govern what you cannot see, and the first honest conversation is worth more than any document. Then pick the tools, write the page, and put someone's name on it.

An afternoon's work, and it turns an unmanaged liability into something that merely needs reviewing occasionally.