Your Team Is Already Using AI. They Just Haven’t Told You.
Not having an AI policy doesn’t mean nobody’s using AI at your company. It means nobody’s telling you how. That distinction is the entire problem. Most small business owners I talk to assume that because they haven’t rolled anything out, nothing is happening. Meanwhile 57% of workers say they’ve concealed their AI use or passed AI-generated work off as their own, and only 22% of employees say their organization has a clear AI plan. People are using it. They know you haven’t said it’s okay. So they’ve decided the safest move is silence.
What this actually looks like inside a business
This is the part that gets lost when people talk about AI in the abstract. Here is what “no AI policy” looks like on the ground, in the businesses I work with:
Your office manager pastes a termination memo into a free ChatGPT account to make it sound more professional. That memo has the employee’s name, their documented performance history, and the reason you’re separating. It is now sitting in a consumer account with no business agreement, no data protections, and no retention controls.
Your recruiter runs resumes through a screening tool nobody vetted, using criteria nobody has ever reviewed for adverse impact. If a rejected candidate ever asks how you made that decision, you don’t have an answer. You have a tool.
A manager drafts an offer letter with AI and it promises a bonus structure your comp plan doesn’t actually support. That letter goes out on your letterhead, and now you either honor a number you didn’t approve or start the relationship by walking something back.
Someone handling a leave request drops the medical certification into a personal Gemini account because it was faster than reading it themselves. Employee medical information has a legally required home, and that isn’t it.
Performance documentation for twelve different employees all reads the same, because the same manager fed the same prompt into the same tool twelve times. If any one of those ever gets challenged, the pattern is the first thing anyone will notice.
None of those people are trying to hurt you. Every single one of them thinks they’re being resourceful. And every single one of them created a file you would rather not hand to an attorney.
This is a documentation problem, not an adoption problem
I fix the process first, then we talk about the tech. It’s true here too. What you’re looking at isn’t really an AI story. It’s the same story as the PTO policy that lived in someone’s head until two people took the same week off. The same story as the 1099 contractor who’s been doing employee work on an employee schedule for three years. The same story as the no-call-no-show where nothing was written down until after it happened. Nothing was documented, so everybody wrote their own version. That’s what people do in the absence of information. AI just made the gap faster and more expensive.
There’s a name for what happens next: Shadow AI. Employees using unapproved tools on personal accounts, with company data, and no one able to train on it or review it or improve it, because no one will admit it’s happening. That’s a data security exposure and a quality control exposure at the same time. HR metrics are business metrics. A culture of fear quietly becomes a compliance line item.
The one-page fix
You do not need a five-year AI roadmap. Nobody has one of those, and anyone claiming otherwise is guessing. You need to write down four things:
Which tools are approved. Name them. Pay for the business tier so you actually get the data protections.
What never goes in. Employee medical information, SSNs and personal identifiers, client confidential data, anything under an NDA, unreleased financials.
Where a human has to review before it leaves the building. Anything that goes to an employee, a candidate, a client, or a regulator.
What happens when someone gets it wrong. Write it before you need it, not after.
That’s the whole document. It fits on one page. AI itself can draft the first version in about twenty minutes, and you should let it.
The part AI can’t do for you
Here is what a tool cannot handle, and it’s the part that determines whether any of the above works. You have to say out loud, in your own voice, that nobody is losing their job over this. Because the reason people hide their AI use isn’t laziness and it isn’t defiance. It’s the quiet suspicion that using AI well is the same as proving they were replaceable all along. Culture matters. But you cannot call it a culture of trust while half your team is hiding what they did between 9 and 5, and you cannot fix that with a company-wide email about how much you value transparency. Build the foundation first: the written policy, the approved tools, the review step, the honest conversation. Then the trust means something.
Write the page. Say the sentence. Ask your team what they’re already using and make it explicit that the answer won’t be held against them. Based on the data, you’re going to be surprised. Not sure whether your policies, documentation, and manager training could actually hold up if someone challenged an AI-assisted decision? Take the free HR Audit and see exactly where your people systems stand in five minutes.
saltandlightadvisors.com/hraudit
Resources to keep building:
Take the free HR Audit - Score your HR systems in 5 minutes and see exactly where your gaps are.
saltandlightadvisors.com/hraudit
Listen to Don’t Waste the Chaos - The podcast for small business owners building strong people operations. https://youtu.be/RxDlv8fUctM?si=CvS-wLhJkwNw1wvc
Get The HR Easy Button - Kerri’s book on building HR systems that actually work for small businesses.
Subscribe to the newsletter - Weekly HR insights for founders, in your inbox every Monday.
saltandlight.myflodesk.com/saltandlightadvisors
Need fractional HR support or want to talk through a specific challenge?
saltandlightadvisors.com/contact
Ready to build foundational HR systems on your own?
