AI policy & training for Singapore SMEs
Use AI at work without leaking client data.
We write a clear AI use policy, check who can see what in Microsoft 365 before Copilot goes live, and train your team to use AI tools safely.
- Written for your business
- PDPA in mind
- Training in plain English
Today
- Public AI tools
- Overshared files
- No written rules
You get
- Approved tools
- Access tidied
- Staff trained
Four signs your team needs AI rules now.
Client data in public chatbots
Contracts, payslips or customer lists pasted into AI tools.
Files shared too widely
Copilot can surface anything a person has access to.
No written rules
Nobody knows which AI tools are allowed.
Unsure about the PDPA
No clear answer when a client asks how their data is used.
Clear rules, tidy access and a team that knows both.
A practical policy, not a legal document nobody reads, plus the clean-up that makes it work.
Set up my AI policyAI use policy
Which tools are approved, what data can go in, and who to ask.
Access review
Overshared SharePoint sites, Teams and files found and fixed.
Sensitivity labels
Sensitive files labelled, so Copilot and sharing rules handle them carefully.
Approved tools
Copilot Chat set as the default, with risky AI sites blocked where needed.
Staff training
Short sessions on safe prompts, checking answers and spotting mistakes.
Yearly refresh
Policy and training reviewed each year as tools change.
What the policy covers
A one-page policy your team will actually read.
We write it with you, in plain English, then set up Microsoft 365 to match.
| Area | What it says | What we set up | |
|---|---|---|---|
| Approved tools | Which AI tools staff may use for work | Copilot Chat on, other tools reviewed | |
| Client and personal data | What must never go into AI tools | Sensitivity labels and sharing limits | |
| Checking AI answers | Who checks output before it is used | Review steps in key workflows | |
| Access | Who can see which files and sites | Access review and clean-up | |
| Questions and incidents | Who to ask, and what to do if data leaks | Contact sheet and incident steps |
This is practical guidance and technical set-up, not legal advice.
Draft my AI policyHow we set it up
Five steps to safe AI use.
Check
AI use check
Which tools staff use today, and for what.
You keep: a usage summary
Write
Write the policy
One page, agreed with you.
You keep: your AI policy
Tidy
Fix access
Overshared files and sites cleaned up.
You keep: an access review report
Train
Train the team
Short sessions by role, with real examples.
You keep: training slides
Review
Yearly review
Policy and settings checked as tools change.
You keep: review notes
Staff training
Training that shows people what to do, not only what to avoid.
Sessions use your own documents and tasks. Staff learn to write good prompts, check answers and keep client data out of tools that are not approved.
- Short sessions, online or at your office
- Examples from your own work
- A one-page guide for every desk
Is Copilot about to show staff files they should not see?
We run a quick check on who can see what in your Microsoft 365 before you switch Copilot on.
AI policy questions SMEs ask first.
Something else? Chat with us or call +65 6031 0102.
Do small businesses really need an AI policy?
If anyone uses ChatGPT, Copilot or similar tools at work, yes. A short policy prevents the most common data leaks.
Is Copilot Chat safe to use at work?
Signed in with a work account, Copilot Chat includes enterprise data protection, and Microsoft states prompts are not used to train its models. We set it as the default tool.
Will Copilot show staff files they should not see?
Copilot only uses what a person can already access. That is why we review and fix sharing first.
Is this legal advice?
No. We give practical guidance and set up the technical controls. For legal questions on the PDPA, speak to your lawyer.
How long does it take?
Most SMEs have a policy, an access review and trained staff within two to four weeks.
Set up your AI policy.
Tell us which AI tools your team uses today. We reply within one business day with a plan.
What happens next
- A reply within one business day from a senior consultant, not a call centre.
- A 30-minute AI use check: tools in use, data at risk and quick fixes.
- A policy outline you keep, with the access fixes to do first.
