--- title: "Company AI policy: five rules for ChatGPT and Copilot" description: "Five rules on one page for using ChatGPT and Copilot without exposing data: approved tools, off-limits data and reviewed access. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/company-ai-policy-chatgpt-copilot/ source: https://www.dataroad-it.com/en/company-ai-policy-chatgpt-copilot/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Five rules on one page for using ChatGPT and Copilot without exposing data: approved tools, off-limits data and reviewed access. No-obligation proposal. # Company AI policy: five rules for ChatGPT and Copilot At a glance For decision-makers short on time. - 01 45% of workers already use AI at work and 67% with personal accounts (Verizon, 2026). - 02 Copilot shows whatever permissions allow: review access before switching it on. - 03 An AI policy fits into five rules on one page, signed by management. - 04 Since 2 February 2025, the AI Act requires AI literacy from every company. ### In this article **A company AI policy costs one meeting and one sheet of A4. Not having one can cost the confidentiality of clients, salaries and contracts.** Before letting the team use ChatGPT at scale or switching on Copilot, the board must settle three things: the authorised tools and the account used, the information that always stays out, and who can open what in Microsoft 365. Below we explain the sequence DataRoad applies with its clients and what the AI Act already requires SMEs to comply with. ## Are your employees already using AI without authorisation? Very probably, yes. Verizon's annual Data Breach Investigations Report (2026 edition) shows that 45% of people regularly use AI on work computers, against 15% a year earlier. Worse: 67% sign in to these services with accounts the company does not control. AI used outside the organisation's control, so-called shadow AI, has become the third most recorded non-malicious internal cause of data leaks. Banning it, therefore, does not work. Without an official alternative, the team uses their phone and personal account, and the company loses track of what goes out. ## What data is exposed when a personal account is used? Everything pasted into the conversation. The examples are mundane: a bank statement sent for summarising, a client's message rewritten by a salesperson, a performance review polished by HR. What changes everything are the terms of service. On consumer versions, OpenAI may use conversations to train its models unless the user turns that setting off. On business subscriptions and the API, the default is the opposite: content is kept out of training. The line between the two worlds is a business account, administered by the company. **A simple comparison:** discussing a deal with AI on a personal account is like negotiating on the phone on a crowded train. With a business account, the conversation moves to a closed room, with house rules and a record of who was present. ## Can Copilot reveal confidential files? It can, if the permissions are already wrong. Microsoft 365 Copilot does not force any door: according to Microsoft's documentation, it only returns information the user can already, at the very least, read. The danger lies in the shares nobody has reviewed. It is what we regularly find in audits. A board folder open to the whole organisation. A link created three years ago to the payroll spreadsheet, valid for any colleague. A SharePoint site for a closed project, with no restrictions. For years this went unnoticed. With Copilot, a question about the sales team's pay can get an instant answer. The order is non-negotiable: first clean up access in SharePoint, OneDrive and Teams; then open Copilot to a restricted group. It is about configuring [the company's Microsoft 365](https://www.dataroad-it.com/en/microsoft-365-management/) properly, not buying more licences. ## Which rules should the AI policy contain? Five are enough. They fit on one page, and it is management that signs, not the engineer. | Rule | Application | Who is responsible | | --- | --- | --- | | **1. A closed list of tools** | Only approved tools, always with company credentials; no private accounts for work matters. | Management and IT | | **2. Prohibited information** | No personal data on clients or staff, clinical information, pay, credentials, contracts or confidential proposals. | All users | | **3. Clean access first** | Shares and open links reviewed in SharePoint, OneDrive and Teams; Copilot starts with a pilot group. | IT | | **4. Review by a person** | AI drafts; someone validates figures, names and facts before the document reaches the client. | Line managers | | **5. Training with a record** | A short session for the whole team and an attendance sheet kept on file: the proof of the literacy required by law. | Human resources | Fold them into the set of [internal security policies](https://www.dataroad-it.com/en/seven-cybersecurity-policies-every-company/) that any organisation with more than 10 people should have documented. ### Checklist before the first pilot - **Authentication** MFA on every account, without exception. - **Leavers** Users who have left deleted and licences returned. - **Public links** "anyone" links audited and switched off wherever possible. - **Restricted areas** Board, HR and finance accessible only to those who need them. - **Test group** 5 to 10 users, with a date set for evaluation. ## What does the AI Act require of an SME today? It requires AI literacy. Regulation (EU) 2024/1689 has been in force since 1 August 2024 and applies in stages. For a company using ChatGPT or Copilot in everyday work, three points matter: - **Since 2 February 2025** The prohibited practices and Article 4 apply. Anyone using AI must ensure their people are sufficiently prepared to use it with judgement. - **July 2026** Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, pushed high-risk obligations back to 2 December 2027 (stand-alone systems) and 2 August 2028 (systems embedded in products). Literacy remained mandatory. - **High risk** Covers, for example, candidate selection, biometrics and critical infrastructure. If AI plays a part in recruitment, seek legal advice. Those who use AI to draft messages, summarise reports or put proposals together do not need certification. They need to show that the team knows the tool, knows where it fails and handles data with care. Rule 5 provides that proof. DataRoad does not provide legal advice. We carry out the technical side (accounts, access, logs) and help prepare the training session. ## How does this work in a company with three offices? [Velv by OnRising](https://www.dataroad-it.com/en/velv-onrising-managed-it-200-workstations/) produces software in Porto, Lisbon and Rio de Janeiro, with around 200 workstations managed by DataRoad under IT Unlimited. Almost half of its revenue (45%) comes from international clients, and the contract covers firewall, network security and protection policies. For a team like that, deciding which client information may pass through an AI is routine, and the rule has to be the same in all three cities. The AI policy joins the existing policy pack and is enforced by the same team that manages identities, access and devices. ## Where should you start this week? - **Ask**: find out which AI services the team uses today. - **Make it official**: choose one tool and give it business accounts. - **Audit**: have access reviewed before any Copilot test. Without MFA across the board, that is the priority: it is the starting point of a [Zero Trust model adapted to SMEs](https://www.dataroad-it.com/en/zero-trust-sme-90-day-plan/). And remember that attackers use AI too: it is worth [preparing people against phishing and deepfakes](https://www.dataroad-it.com/en/phishing-deepfakes-team-awareness-plan/). ## Frequently asked questions about AI policy ### Should we block ChatGPT on the company network? It is not the best option. A block with no alternative pushes use onto phones and private accounts; it is safer to make a business tool official and list the prohibited data. ### Can an employee see through Copilot what they should not? Only if they already have that access. Copilot merely amplifies badly assigned permissions (folders open to everyone, old links), which is why the access review always comes before activation. ### Does a 15-person company also have to comply with AI literacy? It does. Article 4 of the AI Act has applied since 2 February 2025 to any professional use of AI, regardless of size; written rules, a short session and an attendance record are the sensible minimum, and the legal reading is for your lawyer. ### Does using AI safely mean buying licences? No. The essentials are configuring what the company already pays for (MFA, reviewed access, business accounts on the chosen tools) and only then are Copilot licences justified. ## Next step: AI policy and access reviewed in 10 working days DataRoad audits your Microsoft 365 shares, shows you what Copilot would make visible and delivers the rule sheet ready to sign. Protection is part of the [IT Unlimited Premium plan](https://www.dataroad-it.com/en/it-unlimited-premium-on-site-support/) and our complete [managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/). Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** Call +351 211 459 950 * or write to sales@dataroad.pt. **Call to a Portuguese landline.* ## Sources consulted - [Verizon DBIR 2026 (executive summary)](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf) - [Microsoft Learn: privacy and data protection in Copilot](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) - [OpenAI: how data is used to train models](https://openai.com/policies/how-your-data-is-used-to-improve-model-performance/) - [EUR-Lex: text of the AI Act, Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/PT/TXT/?uri=CELEX:32024R1689) - [EUR-Lex: Digital Omnibus on AI, Regulation (EU) 2026/1744](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/por) - [European Commission: new dates for high-risk systems](https://digital-strategy.ec.europa.eu/en/news/eu-agrees-simplify-ai-rules-boost-innovation-and-ban-nudification-apps-protect-citizens) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed IT for business ## One StepAhead of IT. Technology that works quietly, so your team works without interruptions. Engineering precision in every request. - **11** years in business, since 2015 - **1** contract and one owner for everything - **232** clients under management We do **IT** right. DataRoad IT Unlimited ## Operational continuity is not luck. It is method and contract. IT Unlimited reduces risk and shows in writing what changed. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/company-ai-policy-chatgpt-copilot/