Company AI policy: five rules for ChatGPT and Copilot

Very probably, yes. Verizon's annual Data Breach Investigations Report (2026 edition) shows that 45% of people regularly use AI on work computers, against 15% a year earlier. Worse: 67% sign in to these services with accounts the company does not control.

AI used outside the organisation's control, so-called shadow AI, has become the third most recorded non-malicious internal cause of data leaks. Banning it, therefore, does not work. Without an official alternative, the team uses their phone and personal account, and the company loses track of what goes out.

Everything pasted into the conversation. The examples are mundane: a bank statement sent for summarising, a client's message rewritten by a salesperson, a performance review polished by HR.

What changes everything are the terms of service. On consumer versions, OpenAI may use conversations to train its models unless the user turns that setting off. On business subscriptions and the API, the default is the opposite: content is kept out of training. The line between the two worlds is a business account, administered by the company.

A simple comparison: discussing a deal with AI on a personal account is like negotiating on the phone on a crowded train. With a business account, the conversation moves to a closed room, with house rules and a record of who was present.

It can, if the permissions are already wrong. Microsoft 365 Copilot does not force any door: according to Microsoft's documentation, it only returns information the user can already, at the very least, read. The danger lies in the shares nobody has reviewed.

It is what we regularly find in audits. A board folder open to the whole organisation. A link created three years ago to the payroll spreadsheet, valid for any colleague. A SharePoint site for a closed project, with no restrictions. For years this went unnoticed. With Copilot, a question about the sales team's pay can get an instant answer.

The order is non-negotiable: first clean up access in SharePoint, OneDrive and Teams; then open Copilot to a restricted group. It is about configuring the company's Microsoft 365 properly, not buying more licences.

Five are enough. They fit on one page, and it is management that signs, not the engineer.

Fold them into the set of internal security policies that any organisation with more than 10 people should have documented.

Checklist before the first pilot

• Authentication MFA on every account, without exception.
• Leavers Users who have left deleted and licences returned.
• Public links "anyone" links audited and switched off wherever possible.
• Restricted areas Board, HR and finance accessible only to those who need them.
• Test group 5 to 10 users, with a date set for evaluation.

It requires AI literacy. Regulation (EU) 2024/1689 has been in force since 1 August 2024 and applies in stages. For a company using ChatGPT or Copilot in everyday work, three points matter:

• Since 2 February 2025 The prohibited practices and Article 4 apply. Anyone using AI must ensure their people are sufficiently prepared to use it with judgement.
• July 2026 Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, pushed high-risk obligations back to 2 December 2027 (stand-alone systems) and 2 August 2028 (systems embedded in products). Literacy remained mandatory.
• High risk Covers, for example, candidate selection, biometrics and critical infrastructure. If AI plays a part in recruitment, seek legal advice.

Those who use AI to draft messages, summarise reports or put proposals together do not need certification. They need to show that the team knows the tool, knows where it fails and handles data with care. Rule 5 provides that proof.

DataRoad does not provide legal advice. We carry out the technical side (accounts, access, logs) and help prepare the training session.

Velv by OnRising produces software in Porto, Lisbon and Rio de Janeiro, with around 200 workstations managed by DataRoad under IT Unlimited. Almost half of its revenue (45%) comes from international clients, and the contract covers firewall, network security and protection policies.

For a team like that, deciding which client information may pass through an AI is routine, and the rule has to be the same in all three cities. The AI policy joins the existing policy pack and is enforced by the same team that manages identities, access and devices.

1. Ask: find out which AI services the team uses today.
2. Make it official: choose one tool and give it business accounts.
3. Audit: have access reviewed before any Copilot test.

Without MFA across the board, that is the priority: it is the starting point of a Zero Trust model adapted to SMEs. And remember that attackers use AI too: it is worth preparing people against phishing and deepfakes.

DataRoad audits your Microsoft 365 shares, shows you what Copilot would make visible and delivers the rule sheet ready to sign. Protection is part of the IT Unlimited Premium plan and our complete managed cybersecurity. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

• Verizon DBIR 2026 (executive summary)
• Microsoft Learn: privacy and data protection in Copilot
• OpenAI: how data is used to train models
• EUR-Lex: text of the AI Act, Regulation (EU) 2024/1689
• EUR-Lex: Digital Omnibus on AI, Regulation (EU) 2026/1744
• European Commission: new dates for high-risk systems