On Monday, October 26, Sweden's Government Offices, which supports the prime minister and the ministries, blocked staff from reaching the browser versions of ChatGPT and Claude on their work computers. Employees were steered to Microsoft Copilot, which had passed a security review and is covered by an agreement with the government. A smaller group can still use both models through Intric, an approved Swedish platform. Euronews reported that the decision followed a review that found "problematic" uses of AI tools in government work.
The reaction on X was not mostly about Sweden. It was about every workplace where people already paste work into a chatbot. @ihm185 put the lesson plainly: "One gateway you control beats a ban people quietly route around." And @ItsMuzamilRana described the small-business version: "Staff paste customer emails, invoices or job notes into ChatGPT to write replies faster. Nobody's doing anything wrong. But no one has checked which plan you're on, what gets stored, or who can see it."
That second post describes most owner-led service businesses we talk to. The fix is not a 20-page policy. It is one page your team will read.
TL;DR
- Sweden did not ban AI. It blocked unmanaged tools and pointed staff to approved ones covered by a contract. That is the model to copy.
- An AI acceptable use policy for a small business should fit on one page: approved tools, what never goes in, who reviews output, and who to ask.
- The risk is rarely the model. It is a personal account, on unknown terms, holding customer data nobody can see or delete.
- Write the review rule into the policy. AI drafts, your team approves. Nothing AI-written reaches a customer unchecked.
What did Sweden actually do, and why?
The details matter because they are often misreported as a ban on AI.
According to Euronews and The Next Web, the block covers the browser versions of ChatGPT and Claude on Government Offices work computers. Staff were not cut off from AI. They were directed to Copilot, which the Government Offices says it reviewed and tightened, and some staff keep access to OpenAI and Anthropic models through Intric. The Swedish Tax Agency and the National Board of Institutional Care had already restricted AI services, and the Enforcement Authority was reviewing the issue.
Mikael Wettercrantz, the Government Offices' director of digitalization, framed the reason as information security: AI services used without an agreement can put data at risk. In other words, the problem was not that people used AI. It was that they used it on terms the organization never agreed to.
Why a ban is the wrong move for a small business
A government ministry can afford a security team, a procurement process and an approved alternative on day one. A 25-person HVAC company, accounting firm or property manager usually cannot. If you ban AI without giving people an approved option, three things happen:
- People keep using it on their phones, where you have even less visibility.
- The people who were getting real value, often your best staff, quietly stop telling you how they work.
- You lose the chance to set the one rule that actually protects you, which is how output gets checked.
The better pattern is the one @ihm185 described. Pick the tools you will pay for, put them on business terms, and make them easier to use than the alternatives.
What should an AI acceptable use policy include?
Keep it to these sections. If a section does not change what someone does on a Tuesday afternoon, cut it.
| Section | What it says | Example wording |
|---|---|---|
| Approved tools | Which AI tools staff may use for work, on which plan | "Use our company ChatGPT Business or Copilot accounts. No personal accounts for client work." |
| Never paste | Data that does not go into any AI tool | "No full card numbers, Social Security numbers, passwords, medical details or bank logins." |
| Allowed with care | Data that may go into approved tools only | "Customer names, job notes and invoices, only in company accounts." |
| Review rule | Who checks AI output before it leaves the building | "AI drafts, your team approves. A named person reads every customer-facing draft." |
| Disclosure | When to tell customers AI helped | "Say so if a customer asks. Never present AI output as a guarantee." |
| Agents and automations | What needs owner sign-off before connecting | "No AI tool gets access to email, calendar or accounting without approval." |
| Who to ask | One person for questions and new tool requests | "Ask the operations manager before trying a new AI tool with company data." |
How to write it in an afternoon
- List what people already use. Ask the team, without blame, which AI tools they use for work and for what. You will learn more from this than from any template.
- Pick one or two approved tools. For most small teams that means a business plan of ChatGPT, Claude, Gemini or Copilot, chosen to match the software you already run. Business plans give you admin controls and business data terms.
- Write the never-paste list from your own data. A dental office, a law firm and a landscaping company have different sensitive data. Name yours specifically.
- Name a reviewer for each kind of output. Customer emails, quotes, contracts and social posts each need an owner who reads before sending.
- Add a line about agents. Tools that can act, not just chat, are arriving fast. Any AI that connects to email, calendars, payments or customer records should need explicit approval from you.
- Read it aloud at a team meeting. Then pin it somewhere people will see it. A policy nobody has heard is not a policy.
- Revisit it every quarter. Tools and terms change. Put a date on the page.
Which AI tools should a small business approve?
There is no single right answer, and Sweden's choice of Copilot is not a recommendation for you. The government picked it because of a contract and a security review, not because of the model. Use the same logic:
- Match your stack. If your company lives in Microsoft 365, Copilot may be the least friction. If you live in Google Workspace, Gemini is built in. If your work is heavy on long documents, test Claude. If your team uses voice and images, test ChatGPT.
- Pay for a business plan. The point of approval is that the data sits under business terms with admin controls, not someone's personal login.
- Check the data terms yourself. Read the current terms for the plan you choose, including retention and training settings, before customer information goes in.
- Prefer one tool everyone uses over four tools nobody manages.
What about AI agents that act on their own?
A policy written for chatbots is already out of date. This month Anthropic opened a preview of Claude Duet, an agent that monitors connected apps and asks before it sends, pays, signs or deletes. OpenAI and Meta have their own personal agents. Staff will try these with work accounts long before you write a rule for them.
Add one sentence now: no AI tool gets access to company email, calendars, accounting or customer records without owner approval, and every agent must ask before sending, paying, signing or deleting. That one line covers most of the risk that a new class of tools brings.
Common mistakes
- Copying a big-company template. Twenty pages of legal language guarantees nobody reads it.
- Banning without an alternative. Use moves to phones and personal accounts.
- Forgetting the review step. Most AI problems customers notice are unchecked drafts, not data leaks.
- Treating it as an IT document. It is an operations document. The office manager should own it with you.
- Writing it once. A policy dated last year is probably wrong about today's tools.
Verdict
Verdict: Buy the one-page policy, Skip the ban. Approve one or two business-plan tools that match your stack, write a never-paste list from your own data, and put the review rule in writing so AI drafts, your team approves, and nothing reaches a customer unchecked. Add a line covering agents before someone connects one to your inbox. Sweden's lesson for a small business is not "block ChatGPT." It is "decide which tools you trust, on whose terms, and make those the easy choice."
FAQ
What is an AI acceptable use policy?
It is a short document that tells staff which AI tools they may use for work, what information must never go into them, who reviews AI output before it reaches a customer and who to ask about new tools.
Does a small business really need an AI policy?
Yes, if anyone on your team uses AI for work, which is likely. Without one, customer data may sit in personal accounts on unknown terms, and AI drafts may reach customers without anyone checking them.
Should we ban ChatGPT at work?
Usually not. A ban without an approved alternative pushes use onto phones and personal accounts. Sweden's Government Offices blocked unmanaged browser access but steered staff to approved tools, which is the better pattern.
What should employees never paste into AI tools?
Card numbers, Social Security numbers, passwords, bank logins and health details at minimum. Add anything sensitive to your industry, such as legal matter details or patient records, and name the items specifically.
How long should an AI policy be?
One page is enough for most businesses with 5 to 75 people. If a rule does not change what someone does day to day, leave it out.
Do we need to tell customers when AI was used?
Your policy should say when to disclose. A simple rule is to be honest if a customer asks and never present AI output as a guarantee. Some industries have specific rules, so check yours.
How do AI agents change the policy?
Agents can act, not just answer. Add a rule that no AI tool connects to email, calendars, payments or customer records without owner approval, and that agents must ask before sending, paying, signing or deleting.
Who should own the AI policy?
The owner and whoever runs operations day to day, often the office manager. Treat it as an operations document and review it every quarter.