Your team is already using AI. Write the rules before you buy the licences

Ask any team of twenty people whether they use ChatGPT at work, and most will say no. Ask them how they wrote last week's client email, and the answer changes.

AI has already arrived in most UK businesses, just not through IT. It came in through personal accounts, browser extensions and free trials. That is not a disaster. It does mean the first AI project for most companies is not a chatbot or an agent. It is a set of rules.

Why rules come before tools

Buying Microsoft 365 Copilot or ChatGPT Team licences without rules creates two problems at once.

Data goes where it shouldn't. Client names, pricing, CVs and contracts get pasted into tools that were never assessed. Under UK GDPR, your business is still responsible for that data, wherever an employee sent it.

Nobody can tell whether it works. Without an agreed use case and a baseline, six months later you will have a licence bill and a few enthusiastic users, but no answer to the only question the board asks: what did we get for it?

Copilot makes this sharper. It can see everything a user can see in SharePoint, Teams and email. If permissions are messy, and in most growing companies they are, Copilot will surface documents people never knew they had access to.

What "governance" means for a company of 10 to 200 people

It does not mean a committee. It means four things you can finish in a few weeks.

1. A one-page AI use policy. What staff may use, which data never goes into an AI tool (client personal data, credentials, unreleased financials), and who to ask when in doubt. Plain English, signed off by a director.
2. A tools register. A simple list of every AI tool in use: who uses it, for what, which data it touches and whether the vendor trains on your inputs. Most companies find tools they didn't know about.
3. A permissions check before Copilot. Review who can see what in SharePoint and Teams and fix the obvious oversharing first. This step prevents the worst Copilot surprises.
4. One measured pilot. Pick a single repeated task: drafting proposals, summarising meetings, answering routine supplier questions. Measure how long it takes today, give five people the tool, and measure again after four weeks.

How to choose the pilot

A good first pilot has three features:

• it happens every week, so you get enough repetitions to measure;
• a person reviews the output anyway, so a mistake is caught before it reaches a client;
• the time it takes today is easy to count.

Proposal drafts, meeting notes and first-line email triage usually qualify. Anything that makes decisions about people (hiring, credit, complaint outcomes) does not belong in a first pilot.

What you have at the end

After the pilot you have something most companies lack: a number. Hours saved per person per week, error rate, what the team actually liked. With that number, the decision to roll out licences to everyone, or to stop, becomes easy and defensible.

You also have a policy that your insurer, your clients' procurement teams and, if it comes to it, the ICO will recognise as reasonable care.

Where to start this week

Send your team one question: "Which AI tools did you use for work in the last month, and for what?" Make it clear nobody is in trouble. The answers are your first tools register, and usually the best map of where a pilot will pay off.

If you would like a second pair of eyes, at Rubyness we run this as a fixed-scope engagement: policy, register, permissions check and one measured pilot. Book a 30-minute call and we will tell you honestly whether you need it.