Drafting a tricky email, summarising meeting minutes, translating a sales offer: in many small businesses, employees already use ChatGPT, Copilot or Le Chat, sometimes without the boss knowing. A blanket ban rarely works; letting it happen exposes the company to two concrete risks, the leaking of confidential information and the spread of errors presented with confidence. Here are the rules to set, drawing on the recommendations of France’s data protection authority (CNIL), the European AI regulation and one vendor’s documentation.
What the CNIL recommends
In July 2024, the CNIL published its first guidance on deploying a generative AI system within an organisation. It comes down to six points:
- Start from a concrete need and identified uses, rather than deploying a tool without a specific purpose.
- Frame usage with a list of authorised and prohibited uses. The CNIL gives two examples of prohibitions: providing personal data to the system and entrusting it with decision-making.
- Do not overlook the limitations of these tools, in particular their ability to produce inaccurate but plausible results, and the risks to people’s rights.
- Choose a robust system and a secure deployment: favour local, secure and specialised systems or, failing that, check to what extent the provider can reuse the data entrusted to it, and adapt usage accordingly.
- Train and raise awareness among users about prohibited uses and the risks of permitted uses.
- Set up governance that involves, from the outset, the data protection officer if there is one, the person in charge of IT and security, and business managers.
A European obligation already in force: training your teams
The European regulation on artificial intelligence, known as the AI Act, contains an Article 4 on “AI literacy”. According to the European Commission‘s FAQ, updated on 20 October 2026, it has applied since 2 February 2025. It covers providers of AI systems as well as their deployers, which includes a company whose employees use an AI tool in their work, and requires them to take measures to develop the AI knowledge of their staff and of the people who use these systems on their behalf.
The Commission gives an example that will resonate with every micro-business: employees who use ChatGPT to write advertising copy or to translate must be informed of the specific risks, such as “hallucinations”, those false but credible answers. The requirements remain flexible: no certificate is needed, no training format is imposed and no specific level is required. To keep a record of training or awareness-raising activities, the company can log them in an internal register. The Commission nevertheless considers that relying solely on the instructions for use of AI systems could prove ineffective.
Since 2 August 2026, oversight has been the responsibility of national market surveillance authorities. The regulation does not create a criminal offence, but the Commission stresses that a lack of employee training could make a penalty more likely in the event of an incident.
Personal accounts or business plan: the data question
The CNIL’s recommendation to check how the provider reuses data takes on its full meaning here. Conditions vary from one tool and plan to another, and it is up to the provider to specify them. An example from Microsoft: the documentation for Copilot for Microsoft 365 states that neither prompts, nor responses, nor the data Copilot accesses through Microsoft Graph are used to train the underlying large language models, and that Copilot only displays data the user already has permission to access.
This last point has an often-overlooked practical consequence: an assistant connected to email and shared folders will find everything an employee can technically open. Before activating it, it is wise to check access rights to sensitive folders, such as payroll files or contracts. Microsoft also points out that its answers are not 100% guaranteed and should be reviewed before being passed on.
The rules to put in writing
By combining these recommendations, a small business can formalise a short internal charter:
- List the authorised tools, preferably under a company account whose data reuse conditions have been checked.
- Prohibit entering personal data (customers, employees, candidates) and confidential information into tools that have not been approved.
- Require human review of all generated content before it is sent or published, checking figures, names and references.
- Exclude decisions concerning people, such as screening job applications or evaluating an employee, in line with the example of a prohibition given by the CNIL.
- Organise awareness training on hallucinations and confidentiality, and record it in an internal register.
- Appoint a point of contact who keeps the list up to date and answers questions.
Frequently asked questions
Can my employees use ChatGPT with their personal account?
It is up to the company to decide in its internal rules. With a personal account, it has no control over the conditions applied to the data entered; the CNIL recommends defining authorised uses and checking what the provider does with the data.
Is certified training required to comply with the AI Act?
No. The European Commission states that no certificate is needed; the company can keep a record of its training or awareness-raising activities in an internal register.
Can CV screening be entrusted to AI?
The CNIL lists decision-making among the examples of uses to prohibit. For a project involving recruitment, consult the CNIL before getting started.
Is data entered into Copilot used to train the AI?
For Copilot in Microsoft 365, Microsoft says it is not. Each tool has its own conditions: read them before authorising it in the company.
Sources
- How to deploy generative AI? The CNIL provides initial guidance — CNIL, 2024-07-18
- AI Literacy – Questions & Answers — European Commission, 2026-10-20
- Data, privacy and security for Microsoft Copilot — Microsoft Learn, 2026-11-05