Article · · 4 min read
You already have a rule about this. Most founder-led teams do. There's work you'd never put in an email, a client you don't name in a shared document, a number that only ever goes out on a call. Nobody wrote it down. It lives in your head, and it has held up for years, because you were usually the one doing the work.
AI tools are where that stops being enough.
Hypothetical example: a small consultancy, an ordinary busy week.
Someone fairly new asks in the team channel whether they can run a client's intake notes through the tool that drafts summaries. The founder answers quickly, and well: not that client's notes, because of what was agreed with them, but the generic material is fine once the names come out.
One case, sorted. Nobody writes it down.
Later, a different person has a different client and roughly the same question. The founder is on a call and the deadline isn't moving, so they decide for themselves, as sensibly as anyone could with nothing to go on.
Nothing dramatic happens. But the firm now has two unstated rules, and the real one has become whatever seemed reasonable at the time, to whoever was holding the work. That can't be taught, checked, or explained to a client who asks.
So the first question isn't which tool to use. It's which work, which files and which client facts are allowed to leave your business at all.
What people paste into a chat window is the visible part, and the smaller part.
AI tools now work through connectors, note-takers and inbox automations, and each one is a door:
Almost none of that involves anyone typing anything. It involves someone clicking Allow while trying to get a tool working in a hurry. The doors are the thing to look at.
There is an outside floor. If personal data is involved, UK GDPR applies, and the ICO publishes guidance on AI and data protection that's worth reading. That's the minimum.
Above the floor, the obligations are specific to you: what you promised in the contract, what you implied in the kick-off call, what a particular client would be surprised to learn. Nobody outside the business can write that part for you.
Here's a simple test for any piece of work:
> Could you tell the client plainly where it went and why, and would they find that unremarkable?
That decision is yours, made by a person, before anything moves. Once it's written down, a connected assistant can apply it consistently.
Be clear about what this does. Writing your line down doesn't make you compliant or protected on its own, and nobody should promise you that it does.
What it does is smaller and more useful:
That's control and ownership, which is exactly what you want.
This is a plain management question, the same shape as deciding who can approve a discount or sign off a scope change. Two things make it real.
Someone decides. One named person answers the leave-or-stay question when it isn't obvious, and everyone knows who that is. Until they answer, the work stays. A gate that takes a minute gets used. A gate that takes a week gets walked around.
It's written down. A page, in your own words:
Revise it when the work genuinely changes, not every time someone has a deadline. The test is that you can show it to anyone: a new hire on their first morning, a client asking where their material goes, or yourself six months later. Same words every time.
In one sentence: decide what's allowed to leave before you connect anything, write it down plainly, and make one person the one who answers when it's unclear.
Ask what's allowed to leave the building, then wait.
That conversation is usually where we start. The Catalyst takes one real problem, picked together with you, and builds it with your team rather than for them: written down, keys handed over, yours to run without us. If you can't yet name which problem that is, start with the conversation.
Either way, the line is yours to draw. It's best drawn before the work starts moving.