Your teams already use AI without saying so: what should you do?
Employees use ChatGPT and other tools without written rules. The real risks, and the four-step method to regain control without banning everything.
In one year, the use of generative AI has soared in French very small and small businesses: from 31% to 55% according to Bpifrance Le Lab. These uses do not always go through a management decision: a personal account, a free tool, a habit formed without written rules. It is not the employees’ fault: it shows they find a benefit in it. What remains is to regain control.
The four real risks
- Data leaving the company: a contract, a customer file, a payslip pasted into a consumer tool whose terms of use sometimes allow reuse.
- Content published without review: an email, an offer, a post, with an error or an invented claim.
- Decisions made on a wrong answer: a figure, a rule, a legal reference invented with confidence.
- Being unable to answer a customer who asks, in a questionnaire or a tender, which AI tools you use and under which rules.
Why banning does not work
A ban without an alternative moves uses to phones and personal accounts. The gains remain, control disappears. It is better to allow chosen tools, with rules everyone understands.
The four-step method
1. Take stock
Meet the teams, look at the tools actually used, including those nobody has declared. Without judgement: the aim is to know, not to punish.
2. Write a usage charter
One or two pages, no more:
- the tools allowed, and for which uses;
- the data that is off limits: personal, confidential, strategic;
- review: who reviews what before it goes out;
- flagging generated content when necessary.
3. Correct the technical gaps
Informing people who interact with an AI, flagging generated content, keeping records, governing personal data, providing for human approval: these are also obligations under the European AI regulation. See AI Act: what changes for SMEs and mid-sized companies.
4. Keep evidence
A register of the tools in use and a reusable file of evidence: that is what a client will ask for.
In a mid-sized company, a governance issue
The larger the company, the more uses multiply by department, with different tools. The subject then goes beyond compliance: it becomes a question of consistency — the same rules for all, one way of answering customers, a register kept up to date by a named manager.
What we offer
The AI Usage Audit does exactly this work: the inventory of uses, including undeclared ones, the register, the technical gaps, a usage charter, a correction plan and a file of evidence, delivered within five working days. No alarmist talk: the aim is to know where you stand, and to be able to show it.
Sources
- Bpifrance Le Lab, January 2026 barometer of French very small and small businesses: 55% use generative AI, compared with 31% a year earlier.
Frequently asked questions
Should ChatGPT be banned in the company?
A ban without an alternative moves uses to personal accounts, which are even less controlled. It is better to allow chosen tools, with clear rules on the data that can be put into them.
What are the real risks?
Confidential or personal data entered into a consumer tool, generated content published without review, decisions made on a wrong answer, and being unable to answer a customer who asks for guarantees.
What is an AI usage charter?
A short document, written for the teams: the tools allowed, the data that may or may not be put into them, who reviews what, how to flag generated content. It is based on a real inventory of uses.