Approved AI tools
The policy names the AI tools staff can use with company information. FunctionOne sets the controls that back up that list.
AI acceptable use
FunctionOne sets AI tool rules for staff and company data
FunctionOne's AI acceptable use service sets the rules a policy should cover: which AI tools staff may use. Staff sometimes paste company information into public AI tools. We put controls behind the rules, and our security analysts watch connected systems around the clock. The work starts with a security assessment.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
What does a FunctionOne AI acceptable use policy cover?
A FunctionOne AI acceptable use policy tells staff which AI tools they can use with company information and how.
Data that stays out
Staff sometimes paste company information into public AI tools. The policy spells out which data, such as source code, stays out of them.
Monitoring behind the rules
FunctionOne security analysts watch connected systems around the clock. Phishing email monitoring, stolen password alerts and multifactor sign-in back up the policy.
Reports to leadership
Leadership gets a monthly summary and a regular security review from FunctionOne. Leaders who answer to a board, insurer or auditor see owners and next steps in those reports.
Why does FunctionOne treat shadow AI as a security risk?
Verizon's 2026 Data Breach Investigations Report found that 45% of employees are regular AI users, up from 15% the year before, and that 67% use non-corporate accounts. The same Verizon 2026 Data Breach Investigations Report names source code as the data type staff paste most often into outside AI tools. Personal accounts put that code and other company information outside company controls.
IBM's Cost of a Data Breach Report 2026 found that shadow AI, meaning staff using unapproved AI, was involved in 43% of security incidents, up from 20%. IBM's Cost of a Data Breach Report 2026 also found that 68% of breached organizations lacked AI governance and that shadow AI incidents averaged USD 5.39 million. A written policy, with controls behind it, gives staff an approved path for AI work.
NIST's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, from 2024, says acceptable use policies and guidance for generative AI can help decrease risks from misuse, abuse and inappropriate repurposing. From offices in Syracuse, New York and Tampa, Florida, FunctionOne sets these rules as part of fully managed IT or co-managed work beside an in-house IT team.
How does FunctionOne set up AI acceptable use rules?
FunctionOne starts with your current systems and switches on AI tool rules only after your leaders approve the scope.
Run a security assessment
FunctionOne begins with a security assessment for each new client. We review your systems and accounts before we change anything.
Agree scope and rules
Your leaders and our team agree on scope and response rules. Nothing gets switched on until you approve them.
Set AI tool rules
We set rules and controls for which AI tools staff can use with company information. Staff then know where company information can and can't go.
Watch connected systems
Security analysts watch connected systems 24/7. They confirm findings and act within the response rules you approved.
Report to leadership
Leadership gets a monthly summary and a regular security review. Reports name owners and next steps.
What should leaders ask before choosing FunctionOne for AI rules?
Leaders can use these questions to see how FunctionOne handles AI tool use.
| Question a leader asks | How FunctionOne handles it |
|---|---|
| Which AI tools can staff use with company information? | FunctionOne sets rules and controls for those tools. |
| What happens first? | We run a security assessment and review your systems and accounts. |
| Who decides how threats are contained? | Your company approves the response rules, and analysts act only within them. |
| How are AI-driven attacks caught? | We use phishing email monitoring, stolen password alerts, multifactor sign-in and payment request checks. |
| Does our IT team stay in place? | FunctionOne works fully managed or co-managed beside an in-house IT team. |
Who does FunctionOne help with AI acceptable use?
FunctionOne works with established organizations that have outgrown a help desk, from offices in Syracuse, New York and Tampa, Florida.
Owners and executives
Leaders who report to a board, insurer, auditor or parent company get a monthly summary and a regular security review. Reports name owners and next steps.
IT directors with in-house teams
FunctionOne works co-managed beside your IT team. We add AI tool rules and security analysts who watch connected systems 24/7.
Organizations with several offices
FunctionOne runs offices, laptops, phones, servers and cloud from a single control point. AI tool rules then cover staff in several offices at once.
What do leaders ask FunctionOne about AI acceptable use policies?
What should an AI acceptable use policy cover?
An AI acceptable use policy should say which AI tools staff can use with company information. NIST's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (2024) says acceptable use policies and guidance can help decrease risks from misuse, abuse and inappropriate repurposing. FunctionOne sets those rules for clients.
What is shadow AI?
Shadow AI means staff using AI tools the company hasn't approved. IBM's Cost of a Data Breach Report 2026 found shadow AI was involved in 43% of security incidents, up from 20%. FunctionOne sets rules and controls for which AI tools staff can use with company information.
Are employees pasting company data into public AI tools?
Yes. Verizon's 2026 Data Breach Investigations Report says 45% of employees are regular AI users, 67% use non-corporate accounts, and source code is the data type most often pasted into outside AI tools.
Does New York State's AI policy apply to private companies?
No. The New York State Office of Information Technology Services' Acceptable Use of Artificial Intelligence Technologies (2026) binds state agencies, requiring leadership approval before adopting a new AI system, and only encourages others to consider it. FunctionOne sets AI tool rules for its clients.
How does FunctionOne control which AI tools staff use?
FunctionOne sets rules and controls for which AI tools staff can use with company information. We start with a security assessment of your systems and accounts. We then agree on scope and response rules with you before anything is switched on.
How does FunctionOne protect against AI-powered attacks?
FunctionOne defends against AI attacks with phishing email monitoring, stolen password alerts and multifactor sign-in, payment request checks and AI tool rules. Analysts use behavior analytics and threat intelligence, then confirm findings and act within response rules you approve.
Sources
- Verizon, 2026 Data Breach Investigations Report, 2026
- IBM, Cost of a Data Breach Report 2026, 2026
- NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, 2024
- New York State Office of Information Technology Services, Acceptable Use of Artificial Intelligence Technologies, 2026