Ask a small business owner whether the team uses AI, and the answer is often "not really." Ask the team, and the answer changes. In an IBM survey published in 2025, among office workers familiar with AI tools, 79% of Canadian respondents said they use AI at work, and only one in four relied on enterprise-grade AI tools (IBM Canada). This is what people call "shadow AI": AI used at work without the company knowing, or without rules.
It is rarely bad intent
People use AI because it helps: a clearer email, a summary of a long document, a first draft in five minutes. The problem is not the intent. It is that, without rules, each person decides alone what can be pasted into a tool, often a free personal account whose settings nobody checked. KPMG also found that only 24% of Canadians had received AI training (KPMG Canada). Most people are figuring it out alone.
How to find out what your team really uses
- Ask, anonymously. A five-question survey: which tools, for which tasks, with which kind of information, on which account. Anonymity is what gets honest answers.
- Make it safe to answer. Say clearly that the goal is to set useful rules, not to punish anyone.
- Look at what you already pay for. Microsoft 365, Google Workspace and many business tools now include AI features. Check which ones are turned on, and how.
Four first steps
- Pick approved tools. Ideally company accounts, with settings checked, so people have a good option.
- Write down what never goes in. Client names, addresses, contracts, health or financial information: the list depends on your business.
- Require a human check. Nothing produced by AI goes to a client without a person reading it.
- Present it to the team. One page, one meeting, and everyone signs that they read it.
Banning AI rarely works: people keep using it, just without saying so. A clear framework brings the use back into the open, where you can see it and improve it.
To start on your own, try our 2-minute self-check and our free AI use policy template. If you prefer to have it done with you, our Custom AI Policy covers all four steps in 10 business days.