A Practical AI Policy for Small Businesses Using Macs & Microsoft 365

AI is becoming a normal part of everyday business software. Used well, it can save a small team a surprising amount of time.

This article is part of our series on using AI at home and at work.

It can help turn rough notes into a first draft, summarise a long document, prepare a meeting agenda, compare information, improve an email, find information buried in Microsoft 365, or take some of the repetitive work out of administration.

The difficulty for a small business is rarely deciding whether anybody will use AI. Staff may already be using it.

The more useful question is how do we let people use AI productively without putting customer information, company data or important decisions at unnecessary risk?

You don’t need a 30-page AI policy to answer that.

For most small businesses, a short policy needs to establish a few things: which AI services are approved, which business information may be used with them, what staff are expected to check, and who is responsible when AI is used for something important.

A blanket ban can also be counterproductive. If useful tools are simply prohibited, staff may turn to personal AI accounts outside the business’s control instead.

The aim should be to make the safe way of using AI clear and useful enough that people actually follow it.

What AI can be useful for in a small business

A sensible AI policy should begin with what you want people to do, not just a list of things they mustn’t do.

For many Mac-based businesses, good starting jobs include:

improving the wording or tone of an email
turning meeting notes into a task list
creating a first draft of a document
summarising a document the employee is authorised to read
brainstorming ideas or questions
comparing information
preparing an agenda or checklist
finding and summarising information the employee already has permission to access
helping with formulas, presentations and routine Microsoft 365 work

These are jobs where AI can save time while a person can still easily check the result.

The important phrase is first draft.

AI can produce polished-looking work very quickly, but polished isn’t the same as correct. Names, dates, figures, quotations and conclusions still need human checking.

Start by deciding which AI tools are for work

This is one of the easiest ways to reduce risk.

Rather than allowing everyone to choose their own service, approve a small number of AI tools and specify which accounts staff should use.

If your business already uses Microsoft 365, Microsoft Copilot and Copilot Chat are logical places to consider because they fit within the Microsoft 365 environment many businesses already manage.

Paid business versions of other AI services may also be perfectly reasonable choices. The important distinction isn’t simply whether something says ChatGPT, Claude, Gemini or Copilot on the screen.

It’s the particular service, account and business terms you’re using.

A personal AI subscription bought by an employee should not automatically become an approved place for company or customer information.

Microsoft 365 permissions become even more important with Copilot

There’s another consideration for businesses using Copilot with organisational information.

Depending on the service and licence being used, Copilot can work with information the signed-in person is already permitted to access through Microsoft 365.

That’s useful because AI can help someone work across information that’s already part of their normal working environment.

It also makes existing Microsoft 365 housekeeping more important.

If somebody has unnecessary access to an old SharePoint site, an overly broad folder in OneDrive, a Team they no longer require or a shared mailbox that should have been removed after a role change, introducing AI doesn’t automatically correct that.

Before rolling out AI that works with Microsoft 365 information widely, we’d review who can access important SharePoint sites, Teams, shared mailboxes and shared files.

AI doesn’t fix permissions that were too broad to begin with.

What Australian businesses need to consider

AI doesn’t sit outside Australia’s existing privacy rules.

Many small businesses aren’t covered by every part of the Privacy Act, but being a small business doesn’t automatically put you outside it. The type of business you operate and the information you handle can matter.

Health information is an obvious example of information requiring particular care, but customer records, employee information, identity documents and other personal information can also change the risk involved in using AI.

For a small business, the practical approach is straightforward.

Don’t put personal or sensitive information into a public AI service simply because it is convenient.

If an AI system will routinely handle customer, employee or other personal information, establish whether your business is covered by the Privacy Act and whether that particular use is appropriate before making it part of everyday work.

This article is practical technology guidance, not legal advice. Businesses handling health, legal, financial or other particularly sensitive information should check their industry and privacy obligations as part of adopting AI.

Australia has practical guidance for adopting AI

The Australian Government’s National AI Centre provides guidance designed to help organisations introduce AI responsibly.

The approach centres on six practical areas:

deciding who is accountable
understanding the impacts
measuring and managing risks
sharing essential information
testing and monitoring
maintaining human control

This is useful for a small business because responsible use of AI doesn’t have to mean building an elaborate compliance system.

A ten-person business and a large corporation don’t need identical processes. The controls should make sense for what you’re actually asking AI to do.

Where we would start

For a typical small business already using Macs and Microsoft 365, we would keep the first version simple.

Pick a few useful, low-risk jobs where AI can save staff time.

Approve the particular AI services and accounts that may be used for work.

Make one person responsible for maintaining that list.

Decide what information staff may and may not give an AI.

Require a person to check important work before it goes to a customer, becomes public or results in a significant decision.

Then change the policy as you discover genuine uses for AI rather than trying to anticipate every possible scenario before anyone begins.

A practical AI policy you can copy

The following is designed as a starting point for a small business. Replace the sections in brackets and adjust the rules to match the information and work your business handles.

Purpose

We use approved AI tools to save time, improve our work and help staff find, organise, understand and draft information.

AI supports our staff. It does not replace professional judgement, our responsibilities to customers, our privacy obligations or our normal approval processes.

We encourage staff to use approved AI where it provides a genuine benefit and the information and task are suitable.

Approved AI tools

Staff may use only AI services approved by the business for work involving company, customer or staff information.

Approved AI services are used through accounts managed or approved by the business.

[Name] maintains our list of approved AI tools. For each service we record:

the product and plan
who may use it
who controls the account
its approved uses
information that must not be used with it
when it was last reviewed

A personal subscription or free AI account is not automatically an approved business service.

Good uses of AI

Staff may use approved AI tools for suitable low-risk work, including preparing first drafts, improving spelling and tone, creating agendas and checklists, summarising information they are authorised to access, organising notes, brainstorming ideas and assisting with routine administrative work.

Staff should use AI where it genuinely saves time or improves the work, rather than using it simply because the feature is available.

Information that needs special care

Unless specifically approved for the service and task, staff must not give an AI service:

passwords, recovery keys or sign-in codes
payment card or banking details
identity documents
sensitive health information
confidential staff or performance information
confidential legal advice
information protected by a confidentiality agreement
unnecessary customer or employee personal information
complete exports of mailboxes, customer databases or other business systems

When AI can perform the job without identifying someone, remove names and other identifying information first.

If you’re unsure whether information is appropriate, ask before entering it.

Personal AI accounts

Personal ChatGPT, Claude, Gemini, Copilot or other AI accounts must not be used with confidential company information or personal information about customers or staff unless the business has specifically reviewed and approved that service and use.

Privacy settings on a consumer account can be useful, but changing a setting doesn’t make a personal service an approved company system.

Checking AI-generated work

The person using AI remains responsible for the work.

Before AI-generated material is sent to a customer, published, relied upon for an important decision or used to make a payment or commitment, someone checks it.

Check:

names and contact details
dates and amounts
important facts
calculations
who the information is being sent to
whether confidential or personal information has been included
whether sources need checking
whether the finished work actually says what we intend

AI must not be the sole basis for an important legal, medical, financial, employment or safety decision.

Microsoft 365 and Copilot

Staff use Microsoft Copilot for business only through the work account provided or approved by the business.

Copilot may be able to work with Microsoft 365 information that the signed-in employee is permitted to access. It does not correct permissions that are unnecessarily broad.

[Name] periodically reviews access to important SharePoint sites, Teams, OneDrive folders and shared mailboxes, particularly when somebody joins the business, changes role or leaves.

Staff must not use Copilot to deliberately search for company information they do not need for their work.

AI that can control a Mac or another service

AI assistants that can operate a Mac, browser, mailbox or cloud service need approval before being connected to company systems.

Trials should begin with limited information and permissions. Keep human approval enabled for consequential actions and make sure important files are backed up before allowing an AI assistant to modify them.

Extra care is required before an AI is allowed to send messages, delete information, install software, make purchases or run commands automatically.

Local AI

AI running locally on a Mac may be suitable for particular work, especially where keeping information on a business-controlled device provides an advantage.

Local does not automatically mean private.

Before approving it, check the application and model being used, where chats and files are stored, whether any plug-in or feature sends information online, whether its licence permits the intended business use, and how updates and deletion are handled.

Work and home

Business Macs and work accounts should not be shared with family members.

If a Mac is used for both personal and business purposes, use separate macOS user accounts where practical and keep work files, work browser sessions and business password management separate from personal use.

If AI makes a mistake

Staff should tell [name] promptly if they:

give sensitive information to the wrong AI service
connect an unapproved AI application
send incorrect or confidential AI-generated material
discover AI has unexpectedly changed or deleted something
notice suspicious access to an AI or business account

Stop the activity where possible, preserve enough information to explain what happened, disconnect unnecessary access and report the problem.

Prompt reporting is encouraged. Hiding a mistake can make a manageable problem considerably harder to fix.

Review

We review our approved AI services and this policy whenever we introduce a significant new AI tool or use, when a provider materially changes its service, and periodically as part of our normal technology and security review.

Keep a very short AI register

The policy tells staff the rules. A simple register tells the business what it has actually approved.

For a small organisation, this doesn’t need to be complicated.

Record the AI service, business plan, account owner, staff who use it, what it is approved for, information it may access and the date somebody last reviewed it.

This becomes particularly valuable six months later when someone asks, “Why did we connect this service, and who still uses it?”

Don’t make the rollout harder than it needs to be

You don’t need to spend a month implementing this before anyone can benefit from AI.

Start with a few approved tasks and one approved business service.

For example, let staff use an approved work AI account to improve email drafts, summarise appropriate documents and turn meeting notes into action lists.

Show everyone how to check that they’re signed in with the correct account. Give them examples of information they shouldn’t enter. Then deliberately show them an AI-generated answer containing an error and ask them to find it.

That exercise can teach more than a long presentation about AI risk.

As people discover useful new applications, decide whether the benefit justifies changing the policy.

What if something goes wrong?

If personal information has been exposed, act promptly.

For businesses covered by Australian privacy legislation, some data breaches can trigger additional obligations depending on the circumstances and the likelihood of serious harm.

Significant incidents involving personal information should receive appropriate privacy or legal advice.

For an everyday AI mistake that hasn’t exposed sensitive information, the response may be much simpler: stop the action, correct the work, remove unnecessary access and work out what needs to change before the tool is used again.

The aim is to learn from incidents, not make staff frightened of reporting them.

What we would do

For a small business using Macs and Microsoft 365, we’d start by making AI useful rather than making the policy complicated.

Choose a handful of repetitive jobs where AI can genuinely save time. Give staff an approved business AI service rather than leaving everyone to find their own. Explain clearly which information is off limits and require human checking where an error could matter.

For businesses already invested in Microsoft 365, Copilot and Copilot Chat using work accounts are sensible services to evaluate first because they fit naturally into an environment the business is already managing.

Other business AI services can be added when they solve a genuine problem better.

The policy should grow with the business’s use of AI. If nobody can remember the rules without reopening a 40-page document, it probably isn’t a very useful small-business AI policy.

The goal is simpler: help people use AI to do better work, while making the boundaries clear before something goes wrong.

If you’d like help choosing appropriate AI tools, reviewing your Microsoft 365 permissions or putting a practical AI policy in place for your team, contact Your Mac Tech and we can help you set it up.