Write an AI Policy Before Someone Pastes Client Data Into a Chatbot
Dear diary. Today I walked past Brian's desk and saw the entire staff payroll, names, ID numbers, salaries and all, pasted into a free chatbot. He was asking it to "make the table look nicer". I did not scream. I simply went to the kitchen, made the strongest chai of my life, and decided that this company needs an AI policy before lunch tomorrow. Signed, Halima, HR. If you also run a team, consider this your sign: an AI policy for businesses in Kenya is no longer a nice-to-have.
Why your team is already using AI (whether you know it or not)
Here is the uncomfortable truth. If your staff have smartphones, some of them are already using AI tools at work. They are drafting emails, summarising reports, rewriting proposals and, occasionally, pasting things they really should not. Most of them mean well. They are trying to work faster. Nobody told them where the lines are.
Banning AI outright rarely works. People simply carry on quietly on their phones. A short, clear policy works much better, because it tells people what is encouraged, what is allowed with care, and what is completely off limits.
The legal bit, kept simple
Kenya's Data Protection Act 2019 sets out how organisations must handle personal data, and the Office of the Data Protection Commissioner (ODPC) oversees it. Without getting into legal detail, the spirit is clear: if you collect people's personal information, you are responsible for protecting it and using it only for proper purposes.
When an employee pastes customer names, phone numbers, medical details or salary information into a public AI tool, that data leaves your control. You may not know where it is stored, who can see it, or whether it is used to train the tool. For a law firm, a school, a clinic or any business handling client information, that is a risk worth taking seriously. If you are unsure of your specific obligations, speak to a qualified advisor.
What to put in an AI policy for businesses in Kenya
Keep it to one or two pages. If it reads like a Finance Bill, nobody will finish it. Cover these points:
Which AI tools are approved for work use, and which are not
What data must never go into AI tools: personal data, client files, payroll, passwords, contracts, unreleased financials
What AI is encouraged for: drafting, brainstorming, rewriting, summarising non-confidential material
That a human must review anything AI produced before it goes to a client or the public
Whether staff should disclose AI use on certain work, such as reports or client deliverables
Who to ask when unsure, with a real name, not just "management"
What happens if something goes wrong, and that reporting mistakes early is encouraged
Make the safe option the easy option
A policy works best when it comes with practical support. If staff need AI to tidy tables or summarise documents, give them a safer way to do it. That might be a business account on an AI service with stronger data terms, or tools built into your existing systems. It also helps to show people how to anonymise information: replace names with "Client A", remove phone numbers and ID numbers, round off figures.
Train people with real examples, not abstract rules. Show them what a safe prompt looks like and what a risky one looks like. Ten minutes in a staff meeting does more than a forty-page PDF nobody opens.
Review it regularly
AI tools change quickly. New features appear, terms of service change, and staff find new uses every month. Put a reminder in the calendar to review your policy every six months. Ask the team what they are actually using and what problems they have hit. The best policies grow from real experience, not guesswork.
A short sample to start from
If you need something today, start with this and build from there: "Staff may use approved AI tools to draft, summarise and brainstorm. Never enter personal data, client information, financial records or passwords into any AI tool unless it has been approved for that purpose. Always review AI output before sharing it. If in doubt, ask Halima."
Brian, by the way, has been forgiven. He is now the office AI champion and runs a fifteen-minute session every month on using tools safely. Nothing turns a rule breaker into a rule enforcer quite like a scare.
Your next step: draft that one-page policy this week and read it out at your next staff meeting. If you would like AI tools built into your own business systems so data stays where it belongs, talk to Philsoft about it.