Nobody needs to approve this for it to be happening. Somebody in finance is pasting a supplier statement into a free assistant to get it summarised, and somebody in HR is rewriting a warning letter the same way. The decision in front of you is not whether staff use AI. It is whether they do it on an account you can see.
Most UAE companies I sit with have no policy, or one sentence in a staff handbook saying company data must not be shared with third parties: true, unenforced and read by nobody. Meanwhile the work is getting done faster, which is why it will not stop. This is what an enforceable position looks like, and what it costs.
A ban is a decision to stop seeing it
The instinctive response is to prohibit it. It fails for a plain reason: the tools are on personal phones, personal browsers and personal accounts, none of which you administer. A prohibition does not remove the behaviour, it removes your visibility of the behaviour.
Worse, it selects for the wrong people. Cautious staff comply and work slower; the ones who were going to paste the contract in anyway still do, now knowing they must never mention it. When something goes wrong you find out late, and from outside.
The workable position is narrow and boring: a sanctioned tool that is good enough to be worth using, a short list of what may never go into anything, and consequences that are about concealment rather than usage.
A personal account and a company account are different products
This is the part most owners have not been told, and it changes the whole conversation. The difference between the consumer version of an assistant and the business version is contractual, not a matter of how clever the model is.
Microsoft states plainly that in its commercial Copilot service, prompts, responses and the data reached through Microsoft Graph are not used to train the foundation models. Google publishes a training restriction for its enterprise generative AI, and is equally clear that prompts may still be logged for abuse monitoring, so a customer wanting zero data retention has to request an exception rather than assume it. Anthropic’s commercial terms address ownership of inputs and outputs directly.
None of those commitments follow an employee who signs up with a personal email on a free tier. So the same sentence, typed by the same person about the same customer, lands under completely different terms depending on which account was open. That is the argument for providing accounts: not generosity, and not productivity. Terms.
What you can actually see, without surveillance
You do not need monitoring software to learn how much of this is happening, and installing some is usually the wrong first move in a small company: expensive, corrosive to trust, and it tells you what people typed rather than why.
Three cheaper readings. Network or DNS logs at the office show which assistant domains are being reached and roughly how often. Expense claims show who has already bought a subscription personally. And asking directly, once, with an amnesty attached, produces a more honest answer than any log: most people will say what they use if the question is not a trap.
Do that reading before you write anything. A policy written against an imagined pattern of use gets ignored by the people whose actual work it failed to describe.
The classification staff can apply in two seconds
Every policy that fails does so at the same point: it asks an employee at 4pm to decide whether something is confidential. Give them three named buckets instead, in their own working language, with examples from your own business.
Never. Identity documents and their numbers, salary and payroll data, medical information, customer records that name people, anything under a signed confidentiality obligation, credentials and keys, unpublished financials, and legal correspondence. This list is short on purpose and does not bend.
Only in the company tool. Internal documents, draft contracts with names removed, operational data, supplier terms, code from your own systems.
Anywhere. Public material, published marketing, general questions with nothing of yours in them.
Put it on one page. If it takes more than one page nobody will read it, and a policy nobody reads has the same enforcement value as no policy.
Enforcement lives in provisioning, not in prose
A rule that depends on remembering is a weak control. Every rule you can move into how the account is set up is one you no longer have to police.
Provide named company accounts on a business tier rather than a shared login, so use is attributable and is switched off with the person’s other access on their last day. Turn off content-for-improvement settings where the tier offers the choice. Prefer a tool that sits inside your existing permissions model, so it cannot show a user a document they could not open anyway. And treat an assistant account as an access grant rather than a subscription: it belongs in the same review as every other one.
Where a team genuinely needs an assistant on your own material — your documents, your data, your rules — that is a build rather than a subscription, and it is the same decision as connecting a model to a live system, which carries its own four questions. Tothiq builds exactly that kind of company-scoped assistant across the GCC.
The clause about what comes out, which almost everyone forgets
Policies obsess over what goes in. The liability of the last two years has been about what comes out and who took it at face value.
Three lines cover most of it. Nothing generated goes to a customer, a regulator or a bank without a named person having read it. Nothing generated is a source of fact about your own business: numbers come from your systems. And where output is delivered as paid work, the client agreement should say whether assistance was used — finding out afterwards is how a good relationship ends.
This is also where the argument for a company tool stops being about data and starts being about quality: a shared tool leaves a trail you can inspect when something goes wrong, and a personal one leaves a screenshot and a denial.
Who owns this, and the document that proves it
Name one person. Not a committee, and not IT by default if IT is one overworked administrator. The owner maintains the three lists, approves new tools, runs the review and answers exceptions — and the exceptions route is what stops a policy being quietly ignored: somewhere to ask that takes a day, not a month.
Write the policy so that it survives a change of staff and a change of tool. Name categories of tool rather than product names, so the document does not expire when a vendor renames something. And keep it beside the two documents it depends on: the record of what any automated system is allowed to decide for you, and whatever you hold on data protection obligations — the federal PDPL sits under the UAE government’s own summary of data protection law.
What this costs, honestly
For a company of twenty, business-tier accounts for the eight people who actually need one, a day of somebody’s time to write the page and run the sessions, and an hour a quarter for the review. That is the whole bill, and it is smaller than most companies expect because the expensive parts — monitoring, legal drafting, a bespoke build — are not required to reach a defensible position.
The costs that are easy to miss come later: keeping the sanctioned tool good enough that nobody feels punished for complying, and answering exceptions quickly. Both are attention rather than money, and both are why the owner has to be named.
Where the calculation changes is when the assistant stops being a general tool and starts answering on your own documents. That is a project with a scope, a data question and an acceptance test, and it belongs beside your other data protection obligations rather than on an expense claim.
The first two weeks, in order
Week one is reading, not writing: look at the three signals above, ask the question with the amnesty attached, and list the five tasks people actually use assistants for. Week two is the one page, the accounts, and a thirty-minute session per team built on examples from their own inbox rather than principles.
Then set a review date. The tools change quarterly, the tiers change quarterly, and a policy that names a product will be wrong by the time it is printed. What will not change is the three buckets, the named owner and the exceptions route.
The companies that handle this well are not the ones with the strictest rule. They are the ones where a member of staff can say out loud which assistant they used this morning, because there was never a reason to hide it. That is also the condition under which a pilot eventually reaches production: you cannot build on a pattern of use that nobody will admit to.
Frequently asked questions
We are twelve people. Is a written policy not excessive?
One page is not excessive at twelve people, and the smaller the company the more of its sensitive material sits in one person’s inbox. What is excessive at that size is monitoring software, a committee and a tiered approval workflow. Write the three lists, buy three or four company accounts, name yourself as the owner, and revisit it in six months.
Is it not cheaper to let staff use free tools they have already paid for themselves?
It is cheaper in cash and more expensive in terms. A free consumer tier generally carries no commitment that your material stays out of model improvement, no administrative control, and no way to remove access when somebody leaves. Business tiers for a handful of staff cost less than an afternoon of a lawyer’s time.
How do we handle the person who has been doing this for a year already?
With an amnesty, and once. Say clearly that nobody is in trouble for what happened before the policy existed, ask what was used and roughly what went into it, and move those tasks onto company accounts. The alternative is that the single most informed person about your real exposure stays silent.
Does a signed confidentiality agreement with a client stop us using assistants on their work?
Read the clause rather than assuming either way. Many restrict disclosure to third parties without contemplating a processing tool, and some now name AI services explicitly. Where the agreement is silent and the material is genuinely sensitive, ask the client before rather than after. Some will say yes, and the asking costs you nothing.
What should happen if somebody breaks the policy?
Distinguish the two cases. Using a tool that was not on the list, and saying so, is a process failure and the fix is to update the list or explain why not. Putting something from the never list into anything, or concealing what was used when something went wrong, is a disciplinary matter. If the same consequence attaches to both, you have written a policy that rewards silence.