The Operator's
Checklist

A practical, scannable checklist for using AI safely in a small business: what never to paste in, what to ask any AI vendor before you adopt their tool, and a usage policy you can copy and hand to your team today.

What not to paste into AI tools

Passwords, security questions, or MFA codes, for any account, ever.
API keys, secret tokens, or any credential that grants system access.
Social security numbers, government IDs, or passport numbers.
Full credit card or bank account numbers.
Proprietary client data or trade secrets, unless you have an enterprise-tier agreement with the AI provider that covers it.
Anything covered by attorney-client privilege, unless your plan has the right data handling agreement in place.
Full health records or anything covered by HIPAA, unless the provider has signed a Business Associate Agreement (BAA).
Anything you wouldn't want screenshotted and posted publicly. If you hesitate on this one, don't paste it.

Vendor and data-privacy questions to ask before adopting any AI tool

Is our data used to train the model, by default? Can we turn that off?
Do you offer a Data Processing Agreement (DPA), and is it included at our plan tier or an extra cost?
If we handle health data, do you offer a signed Business Associate Agreement (BAA)?
How long is our data retained on your servers, even after we delete a chat on our end?
Do you provide audit logs so we can see what the tool did and when?
What happens to our data if we cancel the subscription?
Which of your plan tiers (Free, Pro, Team, Enterprise) actually includes contractual data protection, not just a policy page?

A simple review habit before anything ships

Nothing AI-generated goes out unread by a human. Not skimmed. Read.
Verify names, numbers, and dates against the original source, not just by rereading the AI draft.
If AI cites a statistic or a source you did not give it, confirm it exists before it ships.
Read it in the client or customer's voice, not your own, to catch tone mismatches.
Match your scrutiny to the stakes: a quick internal note needs less review than anything with pricing, legal language, or a client's name on it.

An AI usage policy starter you can copy today

This is a first draft, not a finished legal document. Edit it to match your business, run it past whoever handles HR or compliance for you, and treat it as a starting point your team can actually follow, not a binder nobody reads.

AI USAGE POLICY — FIRST DRAFT
[Your Business Name]

1. APPROVED TOOLS
We use [Claude / ChatGPT / other] on a [Free / Pro / Team / Enterprise]
plan for business work. Personal AI accounts should not be used for
business tasks involving client or customer information.

2. WHAT NEVER GETS PASTED IN
Passwords, API keys, full SSNs, full credit card or bank numbers, and
any client data not covered by our provider's data agreement. If
you're unsure whether something is sensitive, ask before pasting it.

3. REVIEW BEFORE IT SHIPS
Nothing AI-drafted goes to a client or customer without a human
reading it first, including names, numbers, and dates checked against
the original source.

4. WHO TO ASK
If you're unsure whether something is OK to use AI for, ask
[name/role] before proceeding.

5. REVIEW DATE
This policy will be revisited on [date, e.g. 6 months from today].

Want help putting this into practice?

We'll walk your team through setting this up properly, no jargon, no overkill.

Book a Free Call