ChatGPT at work: rules for employees (the Murano glassmakers' way)

If nobody in your company has ever written down how to use ChatGPT, it's very likely already being used in ten different ways, with personal accounts and data that shouldn't leave the office. An AI usage policy fixes this on a single page: what's allowed, with which tools, which data is off-limits and who checks. At the end you'll find an eight-point template ready to adapt.

The glassmakers of Venice and their rulebook

Venice, second half of the 1200s. Glass is one of the city's most valuable industries, and its masters, the fioleri, give themselves written rules. The oldest known Capitolare of the glassmakers' guild dates to 1271: a statute setting out who may work, how and with what materials. It would be updated for centuries.

In 1291 the Venetian government ordered the furnaces moved to Murano. The most often cited reason is fire risk in a city built largely of wood; but many historians note that concentrating production on an island also made it easier to control who came and went and where the trade's secrets traveled (see the overview on Venetian glass and materials from the Corning Museum of Glass). In the following centuries the rules on glassmakers grew stricter, eventually limiting their freedom to leave the Republic.

You may say: but we don't want to lock our staff on an island! Heaven forbid. The point is different: Venice understood that the value of a craft lies in what its people know, and that this knowledge must be protected with clear rules, written down and known to all. Not with suspicion.

Well, your company today has the glassmakers' problem in reverse. Trade secrets no longer leave on a boat to the mainland: they leave through a text box. Price lists, quotes, contracts, customer data, source code, strategy: one copy and paste into a chatbot on a personal account is enough. You don't need an island. You need a modern capitolare: an AI policy.

Why a policy, not a ban

Banning ChatGPT usually doesn't work. People use it anyway, from their phones, and the company loses all visibility: so-called shadow AI. A well-written policy does three things a ban can't:

• brings usage into the open, with company tools and proper contracts;
• protects data about customers and know-how;
• gives people confidence, because they know what they can do without fear of getting it wrong.

There's also a legal reason. Article 4 of the AI Act, rewritten by Regulation (EU) 2026/1744, asks those who use AI systems to take measures supporting staff AI literacy: a policy plus short training is the simplest way to do it. And in Italy, Law 132/2025, Article 11, requires employers to inform workers about the use of AI in the cases the law provides.

The data traffic light: what can go in

The heart of any policy is a simple data classification. We suggest a traffic light.

The traffic light works because you can remember it in three seconds. Nobody reads a twenty-page policy; an image with three colors, on the office wall or pinned in the team chat, gets read.

Approved tools

The policy must say which tools may be used and with which accounts. Practical rules:

• company accounts only, created by the company, with a company email;
• business or enterprise plans with a data processing agreement and training on your content turned off (check the vendor's terms);
• a short list of approved tools, kept up to date by one responsible person;
• a simple way to request a new tool (a form, an email), so nobody is tempted to go it alone.

For privacy, contracts and data transfers, see our guide on GDPR and artificial intelligence.

Checks, accountability and transparency

Generative AI writes with great confidence even when it's wrong. The policy should say so plainly:

• whoever uses AI is responsible for the result, as if they'd written it themselves;
• every text leaving the company (customer emails, quotes, technical documents) is reviewed by a person;
• figures, quotes, legal references and technical data are checked at the source;
• if you work in a professional firm in Italy, Law 132/2025 (Article 13) requires you to inform clients about the AI systems you use, in clear and simple language;
• if the company uses a chatbot to talk to customers, since August 2, 2026 the AI Act requires people to know they're talking to a machine.

The 8-point policy template

Here's a structure you can copy and adapt. It fits on one or two pages.

1. Purpose. "The company encourages the use of AI to work better, while respecting the data of customers and colleagues and the company's know-how."
2. Approved tools. List of approved tools and the requirement to use company accounts only.
3. Data. The green/yellow/red traffic light, with concrete examples from your own work.
4. Permitted uses. Drafts, summaries, translations, brainstorming, analysis of non-confidential documents, coding support.
5. Prohibited uses. Decisions about people (hiring, appraisals, disciplinary action) left to AI without human review; entering "red" data; creating misleading content; using personal accounts for work.
6. Review and accountability. Every output is reviewed by a person, who remains responsible for it.
7. Contacts. Who to ask about doubts, new tools or mistakes (a named person, not "IT").
8. Training and updates. Short training on joining and a policy review at least once a year.

A professor's tip: write the examples in your company's own words. "Don't paste the customer list from the ERP" works better than "don't enter personal data".

What if someone makes a mistake?

Include a no-blame reporting rule: anyone who realizes they've entered the wrong data tells the contact person right away. If people fear punishment, they hide mistakes, and a hidden mistake does the most damage. Keep disciplinary measures for knowing, repeated violations, in line with the applicable employment contract.

Mind the flip side too: if you plan to monitor employees' activity to check tool use, remember that in Italy Article 4 of the Workers' Statute limits remote monitoring. Involve your employment adviser before switching any such system on.

Typical scenario: an 8-person engineering firm

Picture a building-services design firm with eight people. Two engineers use ChatGPT on their own accounts to write reports; a colleague in admin uploaded a bank statement "to understand the entries". Nobody meant harm, but customer data and banking information ended up in private accounts.

The fix: a business plan for those who need it, the eight-point policy presented in a one-hour meeting, the traffic light on the wall and an internal contact person. Modest cost, much lower risk, and people keep using AI, but out in the open.

The next step

A policy works if people know how to use the tools. That's why the natural next step is AI training for employees. For the full picture, start from our guide to AI for small businesses.

At Penzai we help business owners and small companies write tailored usage rules and train people on real cases. See our services or book a free intro call: in half an hour we'll work out where to start.