Your team is probably already using AI. Here's how to find out.
Plenty of small businesses never decided to start using AI. Their staff just did.
Someone signs up for a free chatbot to write a customer email faster. Someone else connects an AI note-taker to the company calendar so meetings get summarized. A third person pastes a spreadsheet into a chat window to clean up the formatting. None of these people did anything wrong. They found a tool that saves them time. But nobody wrote down which tools are OK, and nobody knows what's going into them.
This isn't a hunch. In Microsoft's 2024 Work Trend Index, 80% of employees at small and medium-sized businesses said they bring their own AI tools to work. The same report found that 61% of SMB leaders say their company lacks a vision and a plan to implement AI, and that 49% are reluctant to admit using AI on their most important tasks (Microsoft, June 5, 2024).
Put those numbers together and you get the usual picture: people are getting real value from AI, the business can't see it, and some staff would rather not mention it.
Why it matters
The risk isn't that people use AI. The risk is what you can't see:
- Where the data goes. Free and personal accounts don't always come with the data terms a business needs. Terms differ by product and by plan.
- What's connected. An AI app that someone "signed in with" their work account may have been granted access to email, files, or calendars.
- What's being pasted. Client names, pricing, financial details, or health information can end up in a tool nobody approved.
You can't make good decisions about any of that until you know what's actually in use.
A blame-free way to find out
You don't need special software to start. You need about an hour and a tone that makes people comfortable telling the truth.
1. Ask, and make it safe to answer. Send a short note: "We want to support the AI tools that help you. Tell us what you're using so we can make sure it's set up safely. Nobody's in trouble." Ask three things: which tools, what you use them for, and whether you've connected them to your work email, calendar, or files.
2. Check what's connected to your accounts. Your Microsoft 365 or Google Workspace admin console can show which third-party apps people have granted access to company accounts, and what each app can reach. If you don't know how to find this, ask whoever manages your IT. Look for AI assistants, note-takers, writing tools, and browser extensions.
3. Sort what you find into three groups.
- Keep and approve: useful, on a business plan, with terms you've read.
- Move to a business account: useful, but on a personal or free plan.
- Switch off: unknown, unused, or connected to more than it needs.
4. Write down the result. A one-page list of approved tools, plus a line on what never goes into AI, is a real starting point. Most of the value comes from simply having it in writing.
What not to do
Don't start with a ban. People who rely on a tool will usually keep using it quietly, and then you're back to not knowing. Don't make it a compliance exercise on day one, either. Start with visibility, then decide.
Where we come in
This is the first thing we look at. Our free AI Risk Snapshot is a 15-question self-assessment and a 30-minute call, and it ends with a one-page summary of your top AI risks. If you want help turning what you find into a short, plain-English policy, that's our AI Policy Quick-Start.
Next, once you know what's in use: three AI rules every small business should write down.
See what your AI can touch. Request a free AI Risk Snapshot, or email [email protected].
Clearfence AI is a security-first AI consulting company for small and medium businesses, on-site across Dallas–Fort Worth and remote nationwide. This article is general information, not legal advice.