Vic Sol · Decision DeskOne-page sheet · 5 min to use
Your team already uses AI without telling you: the three rules
For team leads who suspect (or know) that their people already use AI with no written rule and want to turn hidden use into visible use in a single meeting.
When to use it
You saw an email that was a little too polished and nobody said how it was written.
Someone pasted a client's data into a chat and you found out afterwards.
Your company responded by banning AI and you know they keep using it, only without telling you.
The sheet
The three rules, as they get written in the meeting. Each one fits on a single line.
#
Rule
What to write
Illustrative example
1
One approved tool, so nobody has to go looking for another
Name of the tool, which account it runs on and what kind of work it is for.
"ChatGPT on the company account, for internal drafts and summaries."
2
A short list of what never gets pasted
Types of information, five lines at most.
"Client data, internal numbers, contracts, passwords, anything you would not send to a supplier."
3
One person to ask when in doubt
A name and how to reach them. Not a committee.
"Daniel, by chat. Answers the same day."
How to announce it without punishing anyone (read it as is in the meeting):
"I know several of you already use AI. It is not bad intent: you want to work faster. That is fine."
"What worries me is not that you use it. It is what gets pasted in there. From today, these three rules."
"What happened before today is not reviewed. What happens from today on, is."
"When something works for you, share it. I want to know what helps."
Rules agreed on: ________ · Person for rule 3: ____________ · Reviewed on: ________
How to fill it in 5 minutes
Write rule 1 before the meeting. If there is no approved tool, pick one with IT that same week; in the meantime, name the one they already use.
Rule 2 is written by the team with you. They know better than you what they have been pasting.
For rule 3, write a name that is in the room. If the name sits on another floor, nobody will ask.
Read the four announcement lines as they are. The order matters: acknowledge first, then the rule, and the invitation to share last.
The most common mistake: turning the meeting into a list of prohibitions. A ban does not prevent use; it hides it. Three simple rules protect more and, on top of that, you find out what is working.
The line that is almost always missing
The third announcement line: "what happened before today is not reviewed". Without it, nobody will admit what they used or what they pasted, and the three rules get written over a silence. With it, hidden use comes into the open the same day, which is the only thing that actually protects the data.
Vic Sol · Decision Desk · vicsol.org/resources/ · Free to use with attribution. This sheet structures a conversation; it is not legal, financial or audit advice.
Open the .docx in Word (or the .xlsx in Excel) or print it before the meeting.
Fill the fields with the team; leave the blanks visible, they are the discussion.
Close with one owner, one date and one next action. Nothing else.
Prompt
Generate this sheet for your case
Paste this prompt into ChatGPT, Claude or Gemini together with your proposal, process or policy. It reproduces the sheet with your data and flags what is missing.
Act as a team lead with 15 years of operations experience who has been through this: found out the team was using AI with no rules and, instead of banning it, wrote three simple rules in a single meeting.
Context I am giving you:
- My team and what it does: [e.g. accounts receivable, 12 people]
- AI tools I have seen or suspect they use: [ ]
- Types of information the team handles: [client data, contracts, internal numbers...]
- Tool approved by the company, if any: [name or "none"]
- Person who could answer questions: [name or role, or "not sure"]
What I need: write the three rules and the announcement, with exactly this structure:
1. Rule 1: one approved tool, so nobody has to go looking for another (name, account, what for).
2. Rule 2: a short list of what never gets pasted (types of information, five lines at most).
3. Rule 3: one person to ask when in doubt (a name or role, not a committee, and how to reach them).
4. The announcement for the meeting, in four lines to be read as they are: acknowledge they already use it and that it is not bad intent; say the problem is what gets pasted, not the use; make clear that what happened before today is not reviewed; invite them to share what works.
Output format: a three-row table (Rule · Text · Pending) followed by the four announcement lines. Maximum 300 words. No introduction.
Rules:
- Do not invent people's names or tools; where one is missing, write [PENDING] and tell me which question to ask.
- No threats or sanctions in the announcement. If the context I gave you sounds like punishment, flag it.
- Do not turn rule 2 into a long policy: five lines at most.
- If critical information is missing, ask me at most 3 questions before answering.
- Answer in plain, direct business English, with no sales adjectives.
What to check in the answer:
Does rule 3 have a name that is in the room, or did it turn into "the IT department"?
Does the announcement include the line "what happened before today is not reviewed"? Without it, nobody will share anything.
Does rule 2 fit in five lines? If it grew, ask it to cut back to types of information, not examples.
Vic Sol