Your team already uses ChatGPT. That is the problem.
Ask a room of fourteen people whether they use AI at work and about four hands go up. Ask the same room whether they have ever pasted something from work into a chat window to get help with it and, if you have built enough trust for an honest answer, most of the room goes up.
This is where nearly every small company actually is. Not “considering AI adoption”. Already adopted, entirely by accident, with no decisions taken.
I want to be precise about why that is a problem, because the obvious answer is the less interesting one.
The obvious problem
Yes, company material is going into personal accounts. Client documents, draft contracts, customer emails, price lists, sometimes things with people’s names and details in them.
Whether that matters depends on your industry, your contracts and what specifically is going in. For a lot of small companies the actual exposure is smaller than the compliance anxiety suggests. For some it is a genuine breach of an agreement they signed.
The right move is not a ban. Bans in this area do not produce less usage, they produce less visible usage, and you end up with the same risk minus your ability to see it.
The right move is a short written rule about what goes in and what does not, and an account the company actually controls. That is a Tuesday afternoon of work and it closes most of the gap.
The problem I find more interesting
Here is what I see more often, and it costs more.
Someone in your company has worked out a genuinely good way to use these tools. They have refined a prompt over six weeks until it produces exactly the right kind of first draft for your kind of client. It saves them two hours a week and the output is better than what they were writing before.
That prompt lives in their personal account. It is not written down. Nobody else knows it exists. When they leave, it leaves.
Meanwhile four other people in the same company are solving the same problem from scratch, badly, every morning, because nobody has ever had the conversation where someone says “how are you actually using this”.
That is not a security problem. It is a much older problem wearing new clothes, which is that useful knowledge in small companies lives in individuals and almost never gets captured. AI tools have accelerated it, because the unit of useful knowledge is now a paragraph of text that takes ten seconds to share and that nobody thinks to share.
The third problem, which nobody mentions
The tools do not know anything about your company.
Every conversation starts from nothing. What you sell, what you charge, how you phrase things, what you have already agreed with this client, what your standard terms are, what you decided last March and why. All of it has to be explained again, by hand, every time.
So people explain a bit of it. The easy bit. And they get output that is generic in exactly the way that makes it useless, and they conclude the tool is overhyped, and they stop.
The people who conclude AI is not useful are very often the people who have been using it without giving it any context to work with. They are not wrong about what they experienced. They are wrong about why.
What to do instead
Four things, in order, and none of them require buying anything large.
Find out what is actually happening. Not a survey, a conversation. Ask people what they use it for and what they have given up on. The second half of that question is where the useful information is.
Get an account the company controls. Not because personal accounts are evil, but because you cannot manage what you cannot see, and because the moment someone leaves you want their work to stay.
Write the rule down. One page. What material can go in, what cannot, and who to ask when it is unclear. Short enough that people read it, specific enough that it answers real questions. A policy that says “use good judgement” is not a policy.
Give the tools your context. This is the step that changes the output quality, and it is the one almost nobody does. Assistants that already hold your documents, your prices, your policies and your past work, connected to the systems where the real information lives. That is the difference between a chat window and something that is actually useful in your specific company.
Then, and only then, is it worth talking about automating anything.
The order matters
People want to start at the end. They have read about agents doing work autonomously and they want that, and the honest answer is that a company where four people are pasting client data into personal accounts is not ready for autonomous anything.
Get visibility, get control, get context in. The clever stuff gets much easier after that, and considerably safer.
It is a boring answer. Most of the useful ones are.
If your company is somewhere in this and you want an outside read on it, book a call. Thirty minutes, and you will get an honest answer about how far along you actually are.