Log In
Get Started
Log In
Get Started
Paper Trails > AI Workplace Policies: What We Told Forbes About Preventing a Crisis

AI Workplace Policies: What We Told Forbes About Preventing a Crisis

An AI workplace policy sets the rules before your team gets AI tools, covering which tools are approved, what data never goes into them, who checks the output and what happens when something goes wrong. Forbes used Paper Trails as an example of this in an October 21 story, and I shared how our own policy works, including the day it stopped a change to client tax settings.

In this article, I'll cover what Forbes said about us, what an AI workplace policy should include, what happened when ours went live, and the steps I'd take if I were writing one for a Maine business today.

 

Key Takeaways from this Article

  • An AI workplace policy should be written and in place before employees get AI tools, not after something goes wrong.
  • A good policy names the approved tools, the data that never goes into them, who reviews AI output and how mistakes get reported.
  • Paper Trails allows only licensed AI tools, blocks personal ChatGPT accounts at the firewall and records every AI automation in a register before it runs.
  • Low risk uses like brainstorming need lighter rules than anything touching confidential data, payroll, hiring or customer decisions.

 

What Did Forbes Say About Paper Trails?

Forbes featured Paper Trails as a case study in how a small company can set up AI governance before rolling out AI tools. The story, by Forbes senior contributor Edward Segal, covered how written AI policies can keep a company out of an AI related crisis. I answered his questions by email. Here are a few of the lines he used, quoted from Forbes:

"Strong governance is the place you have to start, before the rollout."

"Every AI automation is recorded in a register before it's used, and every run is logged."

"We definitely tightened too hard, too fast. But it caught some things, which is good."

The piece also mentions our in house AI training course and that employees sign our usage policy before they get access to Claude, the AI tool we use across the company.

 

CTA Icon (2)

 

What Should an AI Workplace Policy Include?

An AI workplace policy is a written set of rules for how employees may use artificial intelligence at work. It should name the approved tools, list the data that can never go into them, say who reviews AI output before it's used, and explain how mistakes get reported and fixed.

Here's how those pieces line up with what we actually do at Paper Trails:

Policy Element What It Covers How Paper Trails Handles It
Approved tools Which AI tools employees may use, and through which accounts Licensed company accounts only. Personal ChatGPT accounts are blocked at our firewall.
Off limits data What can never go into an AI tool Passwords never go into any AI tool, approved or not. Sensitive data only goes into tools we've reviewed and built controls around.
Access and training Who can use AI, and what they have to do first Employees complete our in house AI training and sign our usage policy before they get access. Access is limited to certain roles.
Approval for automations How a new AI workflow gets approved Every AI automation goes into a register before it runs, sorted by risk. Anything that would change sensitive data needs my approval.
Human review Who checks AI output before it's used A person checks anything before it goes into a client's payroll or tax data.
Logging and monitoring A record of what AI tools actually did Every automation run is logged, and we monitor how Claude is used.
Review and updates How often the rules get revisited I review our AI register every quarter, and we adjust rules as we learn which ones are too tight or too loose.

 

You don't need all of this on day one if you're a 10 person office. But the first two rows, approved tools and off limits data, are the ones I'd write down this week.

 

Why Did We Set Up AI Governance Before Rolling Out AI Tools?

We set up AI governance first because a payroll company can't afford to find out what an AI tool does after it's already touched client data. We hold Social Security numbers, bank account numbers, wages and tax information for the businesses we serve. One bad change in that data shows up on someone's paycheck or in a tax notice.

So before anyone got access, we decided which tools were allowed. As I told Forbes, "We only allow licensed tools." Licensed company accounts give us control over where data goes and who can see it. A personal account someone signed up for on their phone doesn't.

We also review each tool and build controls around it before we approve it for anything that touches sensitive data. That's slower than letting everyone pick their favorite app. It's also the only way I'd be comfortable telling a client their data is safe with us.

 

What's the Difference Between Low Risk and High Risk AI Use at Work?

Low risk AI use involves public information and work a person will check anyway, while high risk AI use touches confidential data or drives decisions about people and money. In the Forbes story, Martin Mulyadi, an accounting professor at Shenandoah University, made this same split. He put brainstorming and summarizing public information on one side, and confidential data, financial reporting, hiring and customer decisions on the other.

Here's how that looks in a payroll and HR setting:

  • Lower risk. Drafting a job posting, outlining a training session, summarizing a new federal rule from the agency's own website, or writing a first draft of a client newsletter.
  • Higher risk. Anything involving employee Social Security numbers, pay rates, bank accounts, tax settings, disciplinary decisions or who gets hired.

Your policy should treat these two groups differently. If every use needs the same approval, people will either stop using AI or start working around the rules. Neither helps you.

Another idea from the story that I agree with comes from Andrew Gamino-Cheong, CTO of the AI governance company Trustible. His company doesn't let people use AI for tasks they couldn't do on their own, so the person reviewing the output actually knows when it's wrong. A payroll specialist checking AI work on a payroll run can spot a bad overtime calculation. Someone from marketing can't.

 

How Should You Plan for an AI Mistake?

Plan for an AI mistake by deciding ahead of time who owns the response, how errors get reported and what you'll tell the people affected. Even a careful policy won't catch everything.

Forbes pointed to a high profile example. In June 2026, KPMG pulled a report about AI after companies named in it said case studies about them had been made up, and the errors were linked to AI hallucinations. You can read more in this International Accounting Bulletin report. If it can happen to a firm that size, it can happen to a 20 person business that pastes an AI draft into a client email without reading it.

A few things to settle now:

  • Who employees tell when they spot an AI error, and how fast.
  • Who decides what gets fixed, and who talks to the client or employee affected.
  • A short, approved statement you can adapt if an AI mistake reaches a customer.
  • Where AI policy violations fit in your existing crisis plan or employee handbook.

At Paper Trails, our automations are built to stop and report when something doesn't look right, rather than guess and keep going. For payroll, a paused process is a much smaller problem than a wrong one.

 

What Does This Mean for Maine Employers?

For Maine employers, the first step is assuming your team is already using AI and writing rules that match how they use it. Most small businesses we work with didn't plan an AI rollout. Someone just started using ChatGPT to write emails or build a schedule.

Say you own a restaurant group in Portland with 15 managers. Using AI to draft a weekly schedule or a staff memo is fine. Pasting your payroll export, with names, pay rates and Social Security numbers, into a personal ChatGPT account is not. Or say you're the HR manager for a hotel group with 80 employees across three locations. Your managers may each be using a different tool, with no idea where that data ends up.

Here's where I'd start:

  • Ask your team what they're already using. You'll probably be surprised, and you can't write rules for tools you don't know about.
  • Pick your approved tools and put them on company accounts, not personal ones.
  • Write your data rule in one sentence your whole team can remember. Ours is that passwords never go into an AI tool, even an approved one.
  • Decide who reviews AI output before it reaches a client, an employee's paycheck or a hiring decision.
  • Put the policy in writing, have employees sign it, and review it at least once a year or whenever you add a new tool.

Our guide to using AI responsibly in HR goes deeper on the HR side, and if you're worried about what happens when data does get out, read up on cyber insurance for small businesses. This article isn't legal advice. If your policy touches discipline, monitoring or employee privacy, have an employment attorney review the language.

 

Prefer to learn by watching?   Our monthly educational webinars allow you to hear directly from our team of experts and get answers to real-world payroll and HR issues.  

 

FAQs: AI Workplace Policies

  • Yes, if your employees use AI tools at work, even informally. A short written policy that names approved tools, lists the data that can never go into them and says who checks AI output protects your business and your clients. Most small businesses can start with one page and add to it.

  • An AI workplace policy should cover approved tools and accounts, data that can never go into an AI tool, who can use AI and what training they need, how new AI workflows get approved, who reviews AI output, how AI use is logged, how mistakes get reported and how often the policy is reviewed.

  • That depends on your policy, but personal accounts are risky because the company has no control over where the data goes or who can see it. At Paper Trails, a payroll and HR company in Maine, employees use only licensed company AI tools, and personal ChatGPT accounts are blocked at our firewall.

  • AI output should be reviewed by someone who knows the subject well enough to spot an error and has the time and authority to fix it. At Paper Trails, a person checks anything before it goes into a client's payroll or tax data.

  • Review your AI policy at least once a year and any time you add a new AI tool or change how one is used. AI tools change quickly, so a policy written for last year's tools can miss new risks. Paper Trails reviews its AI register every quarter.

 

What's Next for Our AI Policy?

What's next for us is finding the right balance, keeping the controls that protect client data and relaxing the ones that only slow people down on low risk work. Being featured in Forbes was a nice moment for our team, but the policy will keep changing as the tools do.

If you're writing your first AI policy, or you're not sure what your team is already putting into these tools, we're happy to talk it through with you.

 

Written: October 2026

Written by: Chris Cluff

 

Want help putting this into practice?

Talk with real people here in Maine who work with small businesses like yours every day. 

Reach Out!