Somebody in your office pasted something into ChatGPT this week. Maybe a client email they wanted to sound nicer, maybe a spreadsheet they wanted summarized. Nobody asked you first, and nobody thought they needed to. That’s the reason to write an AI policy Fort Myers offices can live with: one page, plain English, done in an afternoon.
I’m not against these tools. ChatGPT, Copilot and Gemini save time on drafts, summaries and the email you’ve been putting off. The trouble is that most small offices have no rule at all about what goes into them, so every person on staff makes that call alone, usually in a hurry.
What an AI policy actually is (and why a 5 person office needs one)
An AI policy is a short written set of rules for how your staff use AI tools at work. It says which tools are okay, what never gets typed into them, and who checks the output before a client sees it. It doesn’t need a lawyer’s letterhead or twenty pages. (If it runs past one page, nobody reads it anyway.)
Small offices need it more than big ones. A company with 500 people has an IT department blocking websites and watching for this stuff. A 5 person office has you, and you’re busy. A written page costs nothing, and it gives you something to hand a new hire on day one or show a client who asks how you handle their info. If you want to see how big organizations think about this, NIST publishes a free, voluntary AI Risk Management Framework.
What staff are pasting into free AI tools
It’s almost never malicious. It’s someone trying to get through their inbox. The usual suspects:
- Client or patient details, like a name, a date of birth and what they came in for
- Passwords and login info, pasted in along with a “why isn’t this working” question
- Financials: payroll exports, QuickBooks reports, bank statements, tax documents
- Contracts, HR notes and anything marked confidential
Once that text leaves your office, you don’t control where it sits or how long it’s kept.
Then there’s what comes back out. These tools write confident, wrong answers. In 2023 a federal judge in New York sanctioned two lawyers who filed a brief citing court cases ChatGPT had made up (the case is Mata v. Avianca, and the Florida Bar points to it in its own AI guidance). Your version of that is a made up policy number or a wrong deadline in an email to a client, sent under your name.
And watch the browser. In January 2026, researchers at OX Security found two Chrome extensions posing as AI sidebars that were copying ChatGPT and DeepSeek conversations and sending them to an outside server. More than 900,000 people had installed them. An extension like that can read whatever your staff type into a chat window, paid plan or not. It’s the same trick behind the AI phishing emails and voice cloning scams we’ve written about before. Put “AI” on something and people click.
Free vs business AI accounts
A lot of owners don’t know this part. A personal account and a business account from the same company usually come with different rules.
With personal accounts (the free ones, and often the $20 a month kind too), the vendor may use your chats to improve its models unless you go into settings and turn that off. The chat history lives in that one employee’s login, and when they quit it leaves with them. You have no admin view, so you can’t see what was shared and you can’t shut an account off.
Business plans generally flip those defaults. Your data isn’t used for training, you get an admin console, you add and remove users yourself, and you can require a work login with MFA. They cost more per person, and for an office that handles client records I think it’s worth the money. Vendors change these terms a lot, so read the current data page before you pay for anything.
What to put in your one page AI policy
Five things cover most offices.
Start with approved tools, and name them. “ChatGPT Business, signed in with your work email” is a rule people can follow. “Use AI responsibly” isn’t.
Next is the never paste list. Spell out what stays out of every AI tool no matter what: client and patient info, passwords, financial records, anything covered by a confidentiality agreement.
Third, check the output. A person reads every AI draft before it goes to a client, and that person owns what it says.
Fourth, say who to ask. One person (you, your office manager, your IT provider) answers the “can I put this in?” questions so nobody has to guess.
Last, new tools and extensions. Nothing gets installed or signed up for until that same person says yes. That one rule would’ve stopped those Chrome extensions cold.
A simple one page AI policy Fort Myers offices can copy
Fill in the bracketed parts, print it, and have everyone sign.
[Office name] AI use policy
- You may use these AI tools for work: [list the approved tools]. Sign in with your work account only.
- Never enter client or patient information, passwords, financial records or anything confidential into any AI tool.
- Read and correct everything an AI tool writes before it goes to a client, a patient or a vendor. You’re responsible for what you send.
- Don’t install AI browser extensions, apps or plugins, and don’t sign up for new AI tools, without approval from [name].
- If you aren’t sure whether something is okay to share, ask [name] first.
- If you think you pasted something you shouldn’t have, tell [name] right away. You won’t be in trouble for speaking up.
Employee signature: ____________________ Date: __________
Special notes for medical, dental, legal and accounting offices
Medical and dental practices: patient information can’t go into an AI tool unless that vendor has signed a business associate agreement with you, and free consumer accounts don’t come with one. HIPAA doesn’t care that it was a quick summary.
Law firms: the Florida Bar’s 2024 ethics opinion on generative AI says lawyers can use it, but they have to protect client confidentiality and review the work the way they’d review a nonlawyer assistant’s.
Accountants and tax preparers: the FTC Safeguards Rule already requires a written information security program, and tax preparation firms are named in it. Your AI rules belong in that document. The FTC’s business guide to the Safeguards Rule lists what the program has to include.
I’m an IT guy, not your attorney or your compliance officer. Run the details past whoever handles that for you.
How HenkTek can help
HenkTek is a managed IT company that works with small offices in Fort Myers, Cape Coral, Bonita Springs and Naples. If you’d like help writing your AI policy and setting up safe business AI tools for your staff, call (239) 234-2334 or use our contact page. You can read more about our cybersecurity services or start at henktek.com.
HenkTek is a local IT company in Fort Myers that looks after the technology Southwest Florida businesses depend on, from Cape Coral and Bonita Springs to Naples. We handle managed IT, cybersecurity, backups and help desk support, and we explain things in plain English.