Do we need to clean up SharePoint before turning on Copilot?

Yes. Copilot can read anything the person using it can open, so files shared too widely become easy to find. Start with HR, finance and legal folders, then the rest.

Should we ban AI tools instead?

Bans rarely work. People switch to personal accounts on their phones and the company loses all visibility. A short approved list on company accounts is safer and easier to enforce.

Which AI tool should a small company choose?

The one that fits where your people already work. Microsoft 365 companies often start with Copilot, Google Workspace companies with Gemini, and many add ChatGPT or Claude for writing and analysis. Running two on company accounts is fine.

What should an AI use policy include?

The approved tools, what must never be pasted in, a reminder that people own what they send, when to disclose AI use, and who to ask. One page is enough.

GuidesGuides · AI readiness

Rolling out ChatGPT, Claude and Copilot safely in a small company

How to move your team from personal AI accounts to company ones, fix the file permissions AI tools inherit, and write a one-page policy people will actually follow.

8 minute readUpdated October 24, 2026

The short answer

Put every AI tool your team uses on company accounts with single sign-on, clean up file sharing before Copilot or Gemini can read your files, and publish a one-page policy with a short list of approved tools. Then start with a pilot group. Done in that order, AI becomes something your company controls instead of something that happens on personal accounts nobody can see.

The real risk is ordinary

The most common AI risk in a small company is not a dramatic breach. It is someone pasting a customer list, a contract or source code into a personal ChatGPT account, where the company has no visibility, no retention control and no way to remove it when that person leaves.

The second risk is quieter. Assistants built into Microsoft 365 and Google Workspace can read anything the person using them can already open. If an HR folder was shared with "everyone" years ago, the assistant will find it. AI does not create that problem, but it makes it much easier to stumble on.

Step 1: Find out what is already in use

Most companies are surprised by the answer. Before choosing anything:

Ask your team, without blame, which AI tools they use and for what
Check which AI apps people have connected to their work accounts (in Microsoft Entra under Enterprise applications, or in the Google Admin console under app access control)
Look through expense reports and company cards for AI subscriptions
Note what kind of data goes in: customer data, financial data, personal data, code or contracts

Step 2: Choose the tools and move to company accounts

You do not have to pick only one. Many companies run two, for example Copilot inside Microsoft 365 plus ChatGPT or Claude for writing and analysis. What matters is that each tool is a company workspace with an owner.

Tool	Business plans	Good fit	Check before rollout
ChatGPT	Business (formerly Team), Enterprise	General writing, analysis and research	SSO, workspace retention settings, which connectors and custom GPTs are allowed
Claude	Team, Enterprise	Long documents, careful analysis, coding	SSO, retention, which connectors and integrations are allowed
Microsoft 365 Copilot	Add-on for Microsoft 365 business plans	Work inside Outlook, Word, Excel, Teams and SharePoint	File sharing and permissions across SharePoint and OneDrive
Gemini for Google Workspace	Included in or added to Workspace plans	Work inside Gmail, Docs, Sheets and Drive	Drive sharing, shared drives and external sharing

OpenAI, Anthropic, Microsoft and Google all state that business data on these plans is not used to train their models by default. That is the main reason to move off personal accounts. Read each vendor's current terms before you sign, because plans and names change often.

For each tool:

Create one company workspace with an owner at your company
Connect sign-in to Microsoft Entra ID or Google Workspace, so access ends the day someone leaves
Set a retention rule for chats and uploaded files
Decide which connectors, plugins and agents may reach company data, and turn the rest off
Close personal accounts in an orderly way: move what people need, delete the rest

Step 3: Fix what the tools inherit

Copilot and Gemini respect your existing permissions. That is good news and bad news. Before they go live:

Find files and sites shared with the whole company or with "anyone with the link"
Start with HR, finance and legal, then work outward
Remove access for people who no longer need it
In Microsoft 365, add sensitivity labels and data loss prevention rules for the most sensitive files, and use SharePoint's oversharing reports
In Google Workspace, review shared drives and external sharing settings

This cleanup is worth doing even without AI. It is the same work that reduces the damage if an account is ever compromised.

Step 4: A one-page policy and a pilot

A policy nobody reads protects nobody. Keep it to one page:

Approved tools. The short list, and how to ask for a new one.
Never paste in. Passwords, customer personal data outside approved tools, health or payroll data, anything under an NDA unless the tool is approved for it.
Check the output. AI makes confident mistakes. The person who sends it owns it.
Say when it matters. Tell customers or colleagues when AI produced something they will rely on.
Who to ask. One name or one mailbox for questions.

Then train a pilot group of five to ten people from different teams. Collect what worked and what confused them, adjust the settings and the policy, and only then open it to the whole company.

Keep it in order

Remove AI access in the same offboarding step as email and files
Review new AI tools and connectors every quarter, because the market moves fast
Check retention and sharing settings after each major vendor update
Keep a short record of who approved which tool and why

Regulated or sensitive work

For legal, finance, health and engineering work that should never leave your control, consider private options: enterprise plans with stricter data controls, or AI models hosted in your own environment. These cost more effort to run, so keep them for the work that truly needs them.

If you have staff in the European Union, the EU AI Act already expects companies that use AI to make sure their people have a sufficient level of AI literacy. A short training session and the one-page policy go a long way toward showing that.

FAQ

Questions people ask

Short answers to what founders and finance leads ask us most.

Ask us something else

It is much safer on a business plan than on personal accounts. ChatGPT Business and Enterprise give the company admin controls, single sign-on and retention settings, and OpenAI states that business data on those plans is not used to train its models by default.

How SF3 Technologies helps

We set up ChatGPT, Claude, Copilot and Gemini on company accounts with admin controls, clean up the permissions those tools inherit, and give your team a short policy they will follow. SF3 Technologies is a member of the Microsoft AI Cloud Partner Program and advises across every platform without a bias toward any of them. Every workspace is created in your company's name and managed from inside your own Microsoft 365 or Google Workspace through dedicated admin accounts.

Ask for an AI readiness check AI readiness

This guide is general information, not legal advice. Vendor plans and terms change often, so check each vendor's current terms before you buy.