Skip to content
IOmergent
Talk to us
Home Fractional CISO Managed Cloud Security AI Security Solutions Industries Resources About Talk to a CISO

For every company size and skill level

How to adopt AI tools securely

Your team is already using AI. This guide shows how to make it safe without slowing anyone down, with six decisions that work whether you run a 20 person company or a 2,000 person one. Each one has a good place to start, the sign it's time to step up, and the details for whoever runs IT.

In short: name an owner and find the AI already in use, give people company workspaces that are set up right, decide what data can go into which AI, limit what AI can reach and do, train people, and know how to spot and undo problems.

Workforce AI

Turning on AI for your team:
six decisions

Your people will use AI either way. Give them a safe, fast way to do it, sized to the risk your data carries.

Step one

Pick your setting

Ban it Expense anything Paved road Full control
START ON THE PAVED ROAD

Company accounts on a short approved list, a one page data policy, and new tools approved quickly.

  • Ban itUse moves to personal accounts you can't see.
  • Expense anythingFast, but no visibility and no contract protection.
  • Paved roadApproved tools as easy as the personal kind.
  • Full controlAdds device lock, prompt DLP and audit logs.
No regulated data yetThe paved road is enough. Add more when a customer or auditor asks.
Health, payment or contract restricted dataPaved road for everyone, full control for that data only.

Step two

Make six decisions

Each one has a good place to start for most growing companies, and the sign it's time to step up.

  1. 01

    Who decides?

    Start with

    One named owner for the approved tools list. New tool requests answered quickly.

    Step up when

    AI goes into your product or touches regulated data: bring in a security lead for the risk calls and legal review of your AI vendor contracts.

    How to do it
  2. 02

    Which accounts?

    Start with

    A company workspace: Claude Team, ChatGPT Business, Gemini or Copilot. Work leaves personal accounts.

    Step up when

    You need audit logs or a BAA for health data. For Claude and ChatGPT that means the Enterprise plan. Gemini and Copilot include both on business editions, once set up.

    How to do it
  3. 03

    What data goes where?

    Start with

    Public, InternalAny approved tool
    ConfidentialCompany workspace, no training on your data
    RegulatedBAA-covered tools only, or not at all

    This table is your AI policy.

    How to do it
  4. 04

    What can AI reach?

    Start with

    Only the connectors you need, set to read only. Agents that can send, share or delete need a person to approve each action.

    Step up when

    You connect AI to all your company files (Copilot, Gemini or company search): first clean up files shared with everyone or 'anyone with the link', because AI can find anything a person can open.

    How to do it
  5. 05

    How do people learn?

    Start with

    Pilot with one team, then 30 minutes for everyone: approved tools, what never to paste.

    Step up when

    Customers or auditors ask how you train staff on AI.

    How to do it
  6. 06

    How will you know?

    Start with

    A monthly look at tools, spend and connectors. Know how to cut off an app's access.

    Step up when

    You need proof for an audit or an incident review: export audit logs to storage you control (for Claude and ChatGPT, an Enterprise feature).

    How to do it

01 Who decides, and what's already in use?

Do this

  • Name one owner for the approved tools list, and give people a simple way to ask for a new tool and get an answer quickly.
  • Check which third party apps hold access to Google Workspace, Microsoft 365, GitHub and Slack, and remove the ones you don't approve.
  • Ask each team which AI tools they use, and make it safe to answer honestly.
  • Look at expense reports for AI subscriptions.

02 Which accounts, set up how?

Pick the plan

  • Choose the business version of each tool your team uses: Claude Team or Enterprise, ChatGPT Business or Enterprise, Gemini in Google Workspace, Microsoft 365 Copilot.
  • Verify your company domain with each vendor, so work sign ups land in the company workspace, and block new personal accounts on your domain where the vendor allows it (for example Claude's 'Restrict organization creation').
  • Ask people to move work out of personal accounts. A work email on a personal plan is still a personal account.

Set it up before you invite everyone

  • Require single sign on (SSO) and multi factor authentication.
  • Confirm training on your data is off. It's off on business, enterprise and API plans; personal plans need each person to turn it off.
  • Set how long chats and files are kept, and turn off sharing outside the company.
  • Keep the list of owners and admins short.

Check it: in your AI assistant with the free AI Hardening Check, ask “Run the IOmergent AI Hardening Check for our ChatGPT workspace.”

03 What data goes where?

DataWhat it holdsWhere it can go
Public, InternalPublished material, everyday internal workAny approved tool
ConfidentialCustomer data, personal data, source code, anything under NDACompany workspace, no training on your data
RegulatedHealth, payment or government data, anything a contract restrictsBAA-covered tools only, or not at all

Your one page AI policy is the table above, plus three rules

  • Never paste passwords, API keys or tokens into any AI tool.
  • Check AI output before it goes to a customer or into production.
  • Ask the owner before connecting a new AI tool or app to company data.

04 What can AI reach and do?

In your AI workspace

  • List the connectors each tool can use (Google Drive, Microsoft 365, Slack, GitHub) and turn off the rest.
  • Keep connectors read only, set their write actions to 'needs approval', and require admin approval for new connectors and apps.
  • Keep agent features that send, share or delete on manual approval. On plans with roles or groups, turn them on for a pilot group first.
  • Decide who can build custom GPTs, Gems or agents, and who they can share them with.

On people's computers

  • Keep approval prompts on in coding agents and desktop AI apps. No 'skip permissions' or 'YOLO' modes.
  • Allow only trusted MCP servers, plugins and extensions, pinned to a version.
  • Keep secrets out of agent config files; use environment variables or a secrets manager.
  • On company machines, enforce these settings centrally with managed settings.

Check it: in your AI assistant with the free AI Hardening Check, ask “Run the IOmergent AI Hardening Check quick local scan on this machine.”

05 How do people learn the safe way?

Do this

  • Pick two or three jobs AI should help each team with first, so the pilot has a clear goal.
  • Pilot with a small group and write down what works.
  • Run a 30 minute training: the approved tools, what not to paste, how to spot a wrong answer.

06 How will you know, and undo it?

Do this

  • Review usage, spend and new connectors every month, and run the check again after any plan change.
  • Know how to revoke an AI app's access and remove a connector.
  • Rotate any API key or token that was pasted into a chat or a config file.
  • Turn on and export audit logs where your plan has them, and know who can read them.
  • Add AI to your incident response plan and practice it once.

Check it: in your AI assistant with the free AI Hardening Check, ask “How do I revoke an AI app's access to our Google Workspace?”

What you get

A policy that fits on one screen, and people who stop working around you.

  • Fewer personal accounts holding company data
  • A real answer when a customer asks how you govern AI
  • Room to say yes to the next tool

Want an expert review?

The AI Security Assessment looks at what a self-check can't: which AI apps hold access to your email, files and code, and whether your settings really match what was reported.

See the AI Security Assessment