GMK Digital

Free tool · Staff AI Use Risk Scorecard

Are your staff using AI safely?

Answer 12 quick questions about how your team uses ChatGPT, Copilot, Gemini and other AI tools. You'll get a risk score, a prioritised list of fixes and a free AI use policy template you can fill in and share with your team.

Start the scorecard Get the policy template
  • Free
  • 12 questions
  • About 3 minutes
  • Policy template included

The scorecard

Check your team across four areas.

Answer for the business as a whole. “Not sure” scores the same as “No”, because a rule nobody knows about doesn't protect you.

0 of 12 answered

01 / 04

Rules and ownership

Question 01Do you have a written policy that tells staff how they can and can't use AI tools at work?
Why it matters and how to fix it

Write a one-page AI use policy covering approved tools, what data must never go into them, checking output and reporting mistakes. The template further down this page is a ready-made starting point.

Question 02Is there a list of approved AI tools, and a named person who decides what goes on it?
Why it matters and how to fix it

Pick a named owner for AI tools and keep a short list of what's approved and what each tool may be used for. Without one, people sign up to whatever they find, and nobody knows where company data has gone.

Question 03Have staff had training on using AI safely, including what they mustn't share?
Why it matters and how to fix it

A 30-minute session is enough to start: what's approved, what never goes into an AI tool, how to check output, and who to tell when something goes wrong. Repeat it when tools or rules change, and include new starters.

02 / 04

Data and confidentiality

Question 04Do staff know never to paste client data, personal data or confidential information into AI tools that aren't approved for it?
Why it matters and how to fix it

Spell out the categories that must stay out of unapproved tools: personal data, client documents, financial and legal information, passwords and keys. The NCSC advises against including sensitive information in queries to public AI tools.

Question 05Are the AI tools you use on business plans with clear terms on whether your data is used to train their models?
Why it matters and how to fix it

Free and personal AI accounts often have different data terms from business plans. Check each tool's terms, choose business plans that don't train on your data, and switch off training settings where they exist.

Question 06Do you know which AI note-takers and meeting recorders join your calls, and are attendees told?
Why it matters and how to fix it

AI note-takers record and transcribe everything said, often including client and personal information. Approve one tool, tell everyone at the start of a call, and stop recording if anyone objects.

03 / 04

Accounts and access

Question 07Do staff sign in to AI tools with company accounts rather than personal ones?
Why it matters and how to fix it

Company accounts let you see who uses what, apply your security settings and remove access when someone leaves. Work done in a personal account leaves with the person, and so does any company data in it.

Question 08Is two-step verification switched on for every AI tool account?
Why it matters and how to fix it

An AI account holds a history of everything typed into it. Turn on two-step verification for each one, and use your company's single sign-on where the tool supports it.

Question 09Do you control which AI browser extensions and add-ons staff can install?
Why it matters and how to fix it

AI browser extensions can often read every page you open, including email and internal systems. Allow only the ones you've approved, using your browser management settings or device management tool.

Question 10Do AI tools and agents that can read email, files or calendars only get the access they need, and only after approval?
Why it matters and how to fix it

Connecting an AI assistant or agent to email, drives or calendars gives it everything that account can see. Approve each connection, give the narrowest access that works, and review connected apps every quarter.

04 / 04

Output and oversight

Question 11Does a person check AI output before it goes to clients, gets published or is used to make decisions?
Why it matters and how to fix it

AI tools can be confidently wrong about facts, figures, quotes and links. Make the person who sends or publishes something responsible for checking it, and never let AI alone make decisions about people.

Question 12Do staff know how to report an AI mistake or data slip, and do you know what you'd do next?
Why it matters and how to fix it

Tell staff who to contact, and make it clear honest mistakes reported quickly won't be punished. If personal data is involved, you may need to report it to the ICO within 72 hours, so the clock matters.

Press 1 to 4 to answer

This is a self-assessment based on your answers, not a security or legal audit.

The guide

What are the risks of staff using AI at work?

The main risk is data going where nobody decided it should: client details pasted into a free chatbot, a meeting recorded by a note-taker nobody approved, or an AI agent given access to a whole inbox. The tools are useful. The gaps are in the rules around them.

Most of those gaps take an afternoon to close: a short policy, a list of approved tools on business accounts, and a habit of checking output before it leaves the building. The scorecard shows which ones apply to you.

Why it matters

  • Around one in five UK businesses (21%) have adopted some AI tools, according to the government's Cyber Security Breaches Survey 2025/26.
  • Of the businesses using, adopting or considering AI, only 24% had security practices or processes in place to manage the risks from it, and 31% had no plans to put any in place.
  • 78% of people using AI at work were bringing their own AI tools, according to Microsoft's 2024 Work Trend Index survey of 31,000 knowledge workers.

The NCSC's guidance on ChatGPT and large language models points out that queries are visible to the provider, and advises against including sensitive information in queries to public AI tools.

What the scorecard measures

12 questions in four areas, each scored 2 for yes, 1 for partly and 0 for no or not sure, then turned into a score out of 100.

Rules and ownership

Whether staff know which AI tools they can use, for what, and who decides.

Data and confidentiality

Whether client, personal and confidential information stays out of tools that aren't approved for it.

Accounts and access

Whether AI accounts, extensions and agents are under the business's control rather than each person's.

Output and oversight

Whether a person checks what AI produces, and whether mistakes get reported and fixed.

Free AI use policy template

A one-page policy covering the basics most small and medium-sized businesses need. Fill in your details, then copy or download it and adapt it to how your team works. It's a starting point, not legal advice.

AI use policy for Your company

Last reviewed: today. Owner: the person responsible for AI.

1. Purpose and scope

This policy sets out how everyone who works for Your company, including employees, contractors and freelancers, may use artificial intelligence (AI) tools for work. It covers chat assistants such as ChatGPT, Claude, Gemini and Copilot, AI features inside other software, browser extensions, meeting note-takers and AI agents.

2. Approved tools

You may use these AI tools for work: the tools on our approved list. Ask the person responsible for AI before using anything else, including free trials, browser extensions and add-ons. Always sign in with your work account, never a personal one, and keep two-step verification switched on.

3. What must never go into an AI tool

Unless a tool has been approved for that specific purpose, never enter:

  • personal data about clients, staff or anyone else, such as names, contact details or health information
  • client documents or information we've agreed to keep confidential
  • financial, legal or commercially sensitive information
  • passwords, API keys or other access details

If you're unsure, remove names and identifying details first, or ask.

4. Checking what AI produces

You're responsible for anything you send, publish or act on, whether or not AI helped. Check facts, figures, quotes, links and code before using them. Don't use AI on its own to make decisions about people, such as hiring, performance or pricing for an individual.

5. Being open about AI

Tell clients when AI has played a significant part in work they'd expect a person to have done. If you use an AI note-taker in a meeting, tell everyone at the start and turn it off if anyone objects.

6. Connecting AI to our systems

Don't connect AI tools or agents to email, files, calendars or other systems without approval from the person responsible for AI. Approved connections should have the least access that works, and are reviewed regularly.

7. Mistakes and incidents

If you put something into an AI tool that you shouldn't have, or an AI tool does something unexpected, tell the person responsible for AI straight away. Honest mistakes reported quickly won't be held against you. If personal data is involved, we may need to report it to the ICO within 72 hours.

8. Review

This policy is reviewed every six months, and whenever we adopt a new AI tool.

Where to start this week

  1. Ask your team which AI tools they use, without blame. You'll learn more from an honest list than from a ban.
  2. Pick the tools you'll approve and move people onto business accounts with two-step verification.
  3. Send round the policy above, filled in with your details, and talk it through at a team meeting.
  4. Check connected apps in your email and file storage admin settings, and remove AI tools nobody approved.
  5. Set a review date six months from now.

If you'd like help choosing, setting up and training your team on AI tools, that's what our AI tool implementation service does.

How to read your score

  • 0 to 39

    High risk

    Staff are probably using AI in ways you can't see or control, and client or personal data may already be in tools you haven't approved. Start with the data rules and a short written policy this week.

  • 40 to 64

    Some guard rails

    Some basics are in place, but gaps in rules, accounts or data handling leave room for a costly slip. Work through the priority fixes, starting with anything about client and personal data.

  • 65 to 84

    Mostly in control

    Your team uses AI with sensible rules around it. The remaining gaps are usually access: extensions, connected agents and personal accounts that are easy to miss.

  • 85 to 100

    Well governed

    Strong controls across the board. Keep it that way by reviewing your approved tools and connected apps every six months, because AI tools change quickly.

Frequently asked questions

What is shadow AI?

Shadow AI is staff using AI tools the business hasn't approved or doesn't know about, often on free personal accounts. It's common: Microsoft's 2024 Work Trend Index found 78% of AI users were bringing their own AI tools to work. The risk isn't the tools themselves but the data that goes into them without anyone deciding it should.

Can staff use ChatGPT for work?

Yes, with rules. Approve the tools you're happy with, use business accounts rather than personal ones, and be clear about what information must never go into them. The scorecard checks each of these, and the policy template covers them.

Is it a data protection issue if staff paste personal data into AI tools?

It can be. Personal data put into an AI tool is still personal data, so UK GDPR applies just as it would to any other software provider, including having a lawful basis and suitable terms with the provider. The ICO's guidance on AI and data protection is the place to start.

Do AI tools use what we type to train their models?

It depends on the tool, the plan and the settings. The NCSC notes that queries to public AI tools are visible to the provider and are likely to be used to develop the service. Many business plans commit not to: Microsoft, for example, says Copilot prompts and responses aren't used to train its foundation models. Check the terms for each tool you approve.

Is the policy template legal advice?

No. It's a plain-English starting point for a small or medium-sized business. Adapt it to how your team works, add it to your staff handbook, and ask your HR or legal adviser to review it if you work in a regulated sector.

Do we need an AI policy if we're a small team?

Yes, but it can be short. A one-page policy that names your approved tools and says what data stays out of them prevents most problems. The template on this page is about that length.

How often should we review our AI rules?

Every six months, and whenever you adopt a new AI tool or connect one to your email, files or systems. AI tools add features quickly, and a setting that was safe last year may have changed.

Are my answers stored anywhere?

No. Your score is calculated in your browser and nothing is sent or saved unless you ask us for a review. The policy template is filled in on your device too.

Keep going

Free · Live results

AI Automation ROI Calculator

How much could AI automation save your team? Estimate the hours and money saved each year, with payback period and ROI, then adjust every assumption.

Free · 40+ key types

API Key Leak Checker

Is your website leaking API keys? Scan your HTML and JavaScript for secret keys, tokens and passwords any visitor could copy, and see which keys are meant to be public.

Free · 10 checks

AI Prompt Injection Scanner

Is your website hiding instructions for AI? Paste a page's HTML to find invisible text, comments, attributes, schema and Unicode tricks aimed at ChatGPT, Claude and AI agents.

Next step

Use AI with confidence.

We help businesses choose the right AI tools, set them up safely and train their teams to get real value from them.

Talk to us AI tool implementation