AI policy for contractors: rules for staff using ChatGPT with customer data

Why contractors need an AI use policy#

Contractors need an AI use policy because office staff and technicians are likely already using chatbots to write estimate descriptions, customer emails, review replies and job summaries, often in personal accounts. Without a policy, nobody knows which customer details have been pasted where.

The risk in a trades company is specific. Job notes carry home addresses, gate and alarm codes, notes about vulnerable customers and photos of the inside of homes. Call recordings capture voices and payment conversations. A policy that names those records works better than a generic rule about confidential information.

This is general information, not legal advice. Privacy, recording and employment laws vary by state, so have counsel review the final policy.

What goes on the one page#

A one-page AI policy for a trades company has eight short parts, written so a dispatcher or technician can read it in one sitting. Adapt each part to your company, name real people and tools, and keep the language plain.

Post the finished page where work happens. A policy pinned in the dispatch office and saved on technicians' phones gets read; one buried in the employee handbook does not.

• 1Purpose: we use AI tools to save time on writing and research without exposing customer or company information.
• 2Approved tools: only the company AI accounts listed here may be used for work; personal accounts are never used for work content.
• 3Allowed: tasks on the allowed list may be done in approved tools without asking.
• 4Ask first: tasks on the ask-first list need approval from the office manager or COO.
• 5Never: items on the never-paste list may not be entered into any AI tool, including approved ones, unless a system has been approved specifically for them.
• 6Human review: a person checks every AI-written estimate, message or document before it reaches a customer.
• 7Mistakes: if something on the never list is pasted, report it right away to the named contact; reporting is expected and not punished.
• 8Owner and review: the COO owns this policy and reviews it whenever tools, vendors or laws change.

Allowed, ask-first and never-paste lists#

The three lists are the core of the policy, and they work best when they use the record names your team already knows. The table is a starting point for an HVAC, plumbing or electrical company; move items between lists to match your own risk tolerance and tools.

Write the lists as examples, not categories. A dispatcher knows what a gate code is, but fewer people can say whether a gate code counts as personal information. Where staff are unsure which list an item belongs on, the default is ask first.

Automated redaction is a backstop, not a permission#

Automated redaction tools help catch personal details before text reaches a chatbot, but they are a backstop to the policy, not a reason to relax it. Tools that detect names, addresses and phone numbers work from patterns and models, and they miss things.

Presidio, an open-source toolkit for finding and removing personal information in text and images, is candid about this. Its maintainers note that automated detection can miss sensitive information and advise layering other systems and protections on top. A gate code typed casually into a job comment is exactly the kind of detail a pattern can miss.

Keep the never list absolute, even where a redaction step exists, and keep a person in the loop for everything on the ask-first list.

Rolling the policy out to the office and the field#

Rolling out an AI policy works best as a short conversation with real examples, not an emailed attachment. Dispatchers, customer service staff and technicians respond to scenarios from their own day far better than to definitions.

• 1Set up the approved business accounts first, with data-sharing and history settings reviewed by whoever manages your software.
• 2Walk the office team through the three lists using a real job note with the personal details removed.
• 3Cover technicians in a toolbox talk focused on photos, notes and texting customers from personal phones.
• 4Ask everyone to acknowledge the policy in writing, and add it to onboarding for new hires.
• 5Move gate codes and access details into a restricted field in the field service platform so they stop appearing in notes.
• 6Revisit the lists whenever a new AI feature or tool is added.

Illustrative: a gate code, a chatbot and a policy fix#

Illustrative: a fictional plumbing and drain company finds that a customer service representative has been pasting full job notes into a personal chatbot account to draft follow-up emails. Several notes include gate codes, and one mentions a customer's medical equipment.

The COO does not discipline the representative, who was trying to save time. Instead the company sets up an approved business account, writes the one-page policy and moves gate codes into a restricted field so they no longer appear in notes. Follow-up emails are now drafted from a template that pulls only the job type and date, and counsel advises on whether any customer notice is needed.

When company data leaves on purpose#

Company data that leaves on purpose, such as job records licensed to an AI developer, needs its own approval path, separate from day-to-day staff use. The staff policy should say plainly that no employee shares company records with an AI company, data buyer or researcher on their own initiative.

A licensing decision belongs to the owner or authorized signer, after a rights review and privacy preparation. SourceX runs it through the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery, and the SourceX Evidence Packet holds the privacy record and release authorization, so the company can show exactly what left, in what form and who approved it.