Sample deliverable: Safe AI Adoption Workshop

Summary and priority actions

AI is already in daily use across sales, engineering, the office and the floor. Almost all of it runs on personal or free accounts, and none of it is covered by written rules.

The biggest exposure is customer technical data. In the pre-work survey, two estimators said they paste RFQ text and part specifications into a free chat assistant to draft quotes. Several Northfork customer agreements restrict sharing drawings and specs with third parties.

Do these within 10 business days

#	Action	Owner	Due
1	Adopt the AI Acceptable-Use Policy and send the staff guide to every employee	President	Oct 24
2	Move estimating and engineering staff onto the company’s Microsoft 365 Copilot licenses and stop free-tool use for customer data	VP Operations	Oct 24
3	Remove the unapproved meeting note-taker from company calendars and block new sign-ups	MSP IT lead	Oct 17
4	Fix SharePoint permissions on the HR and Finance sites before Copilot rollout expands	MSP IT lead	Oct 21
5	List every customer agreement with data-sharing limits	Quality Manager	Oct 31

What we found

From the anonymous survey (61 responses), the tool review and the session.

Finding	Risk	Detail
Customer specs in a free chat tool	High	Estimators paste RFQ text and specifications into a personal chat account. Under consumer terms, inputs may be used to improve the vendor’s models, and the company can’t see or delete the history.
Unapproved meeting note-taker	High	A free AI note-taker was connected to six calendars. It joins customer calls automatically and stores recordings outside company control.
Overshared files	High	The HR “Reviews” folder and the Finance “Pricing” folder are open to all staff. Any AI assistant that searches company files would surface them.
AI drafts sent unchecked	Medium	Customer service sends some AI-drafted delivery-date replies without checking them against the ERP. Two customers were given wrong dates last quarter.
A homemade automation	Medium	An engineer built a script that sends shop-floor downtime logs to an AI service for summaries. It works well, but it uses a personal API key with no owner on record.
Writing assistant extension	Low	A grammar and writing extension is installed on 30 or more browsers. Fine for general writing, but it reads everything typed into web forms, including the ERP.
Paid Copilot licenses going unused	Opportunity	Northfork already pays for 25 Microsoft 365 Copilot licenses. Only 7 are used regularly. Moving work onto them fixes the top finding at no new cost.

Data classification

Four classes. Every employee should be able to place a document in one of them in under 10 seconds.

Class	What it covers at Northfork	Examples
Public	Already published, or meant to be	Website copy, published job postings, brochures
Internal	Day-to-day business information with no customer or personal data	Internal SOPs, meeting notes without customer names, general emails
Confidential	Customer, supplier or commercial data	RFQs, quotes, pricing, customer part specs, supplier contracts, production schedules
Restricted	Data with legal or contractual limits, or high harm if leaked	Customer drawings and CAD files, medical-device customer documentation, payroll, reviews, SSNs, bank details, export-controlled technical data

Approved-tools list

Tool	Rating	Approved for	Conditions
Microsoft 365 Copilot (company account)	Green	Public, Internal, Confidential	Company sign-in only. Restricted data only after the permissions fix and Quality Manager sign-off for each customer.
Copilot Chat in Microsoft Edge (work account)	Green	Public, Internal, Confidential	Must show the work-account protection indicator. If it doesn’t, treat it as a free tool.
ERP vendor’s built-in AI features	Yellow	Internal, Confidential	Allowed after the MSP confirms the vendor’s data terms. Don’t turn on new AI modules without review.
Grammar and writing extension	Yellow	Public, Internal	Turn it off on the ERP, payroll and banking sites. Business plan required.
Downtime-summary automation	Yellow	Internal	Approved once moved to a company-owned API key with a named owner (VP Operations).
Free or personal chat assistants (any vendor)	Red	Public only	Never for Internal, Confidential or Restricted data.
Free AI meeting note-takers	Red	None	Remove from company calendars. Use Teams’ built-in transcription for internal meetings.
Free online PDF, image or file “AI” converters	Red	None	Uploading customer files to unknown sites is not permitted.

To request a new tool: email the AI owner (VP Operations) with the tool name, what you’d use it for, and the data class involved. Expect a decision within 5 business days.

Data-handling grid

	Public	Internal	Confidential	Restricted
Green tools	Yes	Yes	Yes	Approval required
Yellow tools	Yes	Within listed conditions	Only where listed	No
Red tools	Yes	No	No	No
Unlisted tools	Request it first	No	No	No

Public

Internal

Confidential

Restricted

Green tools

Yes

Approval required

Yellow tools

Yes

Within listed conditions

Only where listed

Red tools

Yes

Unlisted tools

Request it first

AI Acceptable-Use Policy

Northfork Precision, Inc.: AI Acceptable-Use Policy
Version 1.0 · Effective October 24, 2026 · Owner: VP Operations · Review: every April and October

6.1
Purpose. Northfork wants employees to use AI tools to work faster and better. This policy sets out which tools to use, what data can go into them, and who is responsible for the results.
6.2
Scope. This policy covers every employee, temporary worker and contractor using any AI tool for Northfork work, on any device, including personal phones and home computers. “AI tool” means any software that generates text, images, code, summaries or decisions, including AI features inside software Northfork already uses.
6.3
Approved tools. Use only the tools on the Approved-Tools List, under their listed conditions. Sign in with your Northfork account. Don’t use personal accounts for Northfork work.
6.4
Data rules. Follow the Data-Handling Grid. Never put Restricted data into any AI tool without written approval from the AI owner. Never put Confidential data into a Red or unlisted tool. If you’re not sure of a document’s class, treat it as Restricted and ask.
6.5
Human review. You are responsible for anything you produce with AI. A person must review AI output before it goes to a customer or supplier; goes into a quote, contract, certification or quality record; or is used in any hiring, pay, discipline or other employment decision. Check facts, numbers and dates against the source system, not the AI’s answer.
6.6
Building automations. Before building or connecting any automation, agent or script that sends company data to an AI service, get approval from the AI owner. Every automation needs a named owner, a company-owned account or key, and a short written description of what it does and what data it touches.
6.7
Meetings and recordings. Don’t connect AI note-takers or recording bots to company calendars unless they’re approved. Tell external participants before recording or transcribing a call.
6.8
Reporting mistakes. If you put data somewhere it shouldn’t go, tell the AI owner or your manager the same day. Prompt, good-faith reporting won’t lead to discipline. Hiding it might.
6.9
Roles. The AI owner (VP Operations) keeps the Approved-Tools List current, decides on requests and leads the twice-yearly review. The managed service provider applies account settings, access controls and blocks. Managers make sure their teams know the rules. The Quality Manager keeps the list of customer data-sharing limits.
6.10
Violations. Breaking this policy is handled under Northfork’s existing employee handbook.
6.11
Review. This policy is reviewed every April and October, and whenever a major new tool is approved.

Approved by: ______________________ (President) Date: ____________

One-page staff guide

Using AI at Northfork

AI is welcome here. Use it to save time. Just follow these rules.

Use these

Microsoft 365 Copilot, signed in with your Northfork account
Copilot Chat in Edge, when it shows the work-account protection indicator

Never paste these into any AI tool

Customer drawings, CAD files or part specs
Pricing and quotes, in any free or personal tool
Payroll, reviews or anything about an employee
Social Security numbers or bank details

Always check before you send

AI makes mistakes with numbers and dates. Before anything goes to a customer, into a quote, or into a quality record, check it against the ERP or the drawing.

Not sure? Made a mistake?

Treat it as private and ask the VP Operations. If something slipped, tell us the same day. Honest mistakes reported quickly won’t get you in trouble.

Rollout plan

When	Step	Owner
Week 1	President approves the policy. MSP removes the note-taker and fixes HR and Finance permissions.	President, MSP
Week 2	Staff guide emailed and posted at time clocks. A 10-minute walkthrough at each shift start-up meeting.	VP Operations, managers
Week 2	Estimators and engineers moved onto Copilot licenses, with a 30-minute how-to session.	VP Operations
Week 3	Downtime automation moved to a company API key and documented.	Engineer, VP Operations
Week 4	Quality Manager delivers the list of customer data-sharing limits. Policy updated if needed.	Quality Manager
Day 90	Short follow-up survey on tools in use and whether the rules are clear. Copilot usage reviewed.	VP Operations
April 2027	First scheduled policy review.	AI owner

Suggested next step

The survey turned up three strong time-saving candidates: RFQ intake and quote drafting, delivery-date replies drafted from the ERP, and shift downtime summaries. An AI Opportunity Workshop would score them against Northfork’s on-time-delivery and quote-turnaround goals and scope the first one to build.

Operational guidance, not legal advice. A client’s counsel should review the policy before it is adopted.

Safe AI adoption plan for Northfork Precision