What can I put in the AI tool?

That is the question. Not which model is best, not whether AI will replace anyone, not what the regulators are going to do. In the rooms we have talked to this year, business owners and operators keep coming back to the same practical thing: one of my people wants to paste a document into a chat tool to get a summary. Is that allowed, and how would I know?

It is a fair question and most companies cannot answer it, because AI did not arrive through a decision. It arrived through individual people solving real problems. Someone pasted a client contract into a chat tool to pull out the dates. Someone connected an AI note-taker to the calendar so meetings would write themselves up. Someone built a spreadsheet formula with a model's help and never mentioned it. None of that is reckless. It is just undocumented, and undocumented is the part that becomes a problem later.

Three things that turn it into a problem

The first is confidentiality. A lot of client and employee information is covered by something: a contract clause, HIPAA, a state privacy law, a customer's own vendor agreement. Pasting that material into a consumer tool can be a disclosure to a third party, and whether it is depends on which tool, which plan, and what the terms say about training on your inputs. Most staff have no way to know that, and most companies have never told them.

The second is procurement. Vendor security questionnaires started asking about AI this year, and the questions are specific. Do you use AI in delivering this service. What customer data enters those tools. Who approved them. Can you show us the policy. A company that cannot answer gets slowed down at exactly the moment a deal is closing, and "we are not sure" is the answer that costs the contract.

The third is accuracy. A model that summarizes a contract will sometimes summarize it wrong, with complete confidence. If that summary becomes the basis for a decision and nobody checked it against the document, the error is now yours.

What a usable policy actually looks like

Here is the part that surprises people. The fix is short. You do not need a management system, an external audit, or a committee. For most small and mid-sized companies, three things written down cover it.

A sanctioned tool list - which AI tools are approved for work use, and on which plan. One or two is a fine answer. A short list people actually follow beats a long list nobody reads.

A data rule - what may go into an approved tool, and what may not. Write it in the language of your own business rather than in categories. Client contracts, patient information, employee records, anything with a social security number, and anything a customer has told us to keep confidential do not go into an AI tool, in any form, including a screenshot. That one sentence is worth more than a policy document, because people remember it.

An approval route - how a new tool gets added. Usually one named person, one email, and a decision inside a week. Without a route, people do not stop using new tools. They just stop telling you.

Add one line about human review for anything that touches a customer, a contract, or a decision about a person, and that is a policy.

Where the frameworks come in

Two names come up constantly and they are not the same thing. The NIST AI Risk Management Framework is voluntary guidance that gives you a way to think about AI risk across four functions: govern, map, measure and manage. Nobody certifies you against it. ISO/IEC 42001 is an auditable management system standard, the way ISO 27001 is, and a customer or a regulator can ask to see the certificate.

For most companies the honest sequence is to use the NIST framework to find out what you actually have, then decide whether certification is worth the cost. Certification is a real expense. It is the right answer for some firms and premature for most.

Either way the first step is the same, and it is not a document. It is an inventory. Which AI tools are in use here, who approved them, what data goes into them, and which ones touch a decision about a customer or an employee. Almost every company we talk to is surprised by that list.

Start there

If you are being asked about AI by a customer, an insurer or your own team, the work is smaller than it sounds. An afternoon of asking people what they are already using, a one-page rule about data, and a named person who decides on new tools gets you further than a policy binder nobody opens.

NetSecurely is a veteran-led cybersecurity and compliance firm in Florida. We work with small and mid-sized companies, and with organizations in regulated industries, on exactly this: finding out what is actually running, writing the rule that fits the business, and being able to prove it when someone asks.

If that is the conversation you are in, a short call costs nothing: https://netsecurely.com/service-page/free-discovery-call-15-to-30-minutes