The six-personal-accounts point is the one I'd lead with when talking to an owner. A quick way to make the switch stick: pull the last two months of expense reports, list who is already paying for ChatGPT, and move those same people onto the Business workspace first, so the migration costs nothing extra. Then put your one-page policy straight into the workspace as a pinned Project, with instructions like "Never include client names or account numbers; flag anything that needs a human check before it goes out."

For the review rule, I'd make it concrete: any AI draft that goes to a client gets a named reviewer and a short checklist (figures match source, tone fits, nothing confidential). A simple prompt that helps reviewers: "List every number and claim in this draft so I can verify each one." Your five yes/no questions also make a handy one-page checklist for the IT or contracts owner.