Why keep it simple
Many organizations either have no guidance on AI tools or have a long document no one reads. A short policy that people can remember, ideally one or two pages, has a better chance of changing behavior. Its job is to make everyday decisions easier: what can I use, what can I put into it, and what do I do with the result?
This article describes what such a policy should cover. It is general information, not legal advice. Policies touching employment, privacy, health, finance or regulated activity should be reviewed by a qualified professional in your jurisdiction.
Write for the reader
Use plain sentences and concrete examples. Avoid jargon, and define any term you must use. Say “do not paste customer names into tools that are not on the approved list,” not “personally identifiable information shall not be disclosed to unauthorized third-party systems.” If a staff member cannot explain the rule to a colleague after reading it, simplify it.
Involve some of the people who will follow the rules when drafting. They will spot situations you did not anticipate, and they are more likely to follow rules they helped shape.
Core sections
1. Purpose and scope. Two or three sentences: why the policy exists, who it applies to (employees, contractors, volunteers) and which tools it covers. Keep the definition of “AI tool” practical: anything that generates, summarizes, classifies or predicts using machine learning, including features built into other software.
2. Approved tools and how to request new ones. List the tools that are allowed for which purposes, or say where the current list lives. Give a simple route for requesting something new, with a contact and a typical response time. A usable request path is the best defense against shadow AI.
3. What data may and may not be entered. This is the most important section. Spell out categories that must not go into unapproved tools, such as customer details, employee records, health information, financial data, confidential contracts and credentials. Explain the reasoning briefly, drawing on customer data protection and wider data protection practices. If some approved tools are cleared for certain data, state exactly which ones and for what.
4. Human review. Say that people remain responsible for work they produce with AI help. Outputs must be checked before use, with more care for anything customer-facing, financial, legal, medical or related to hiring. Because tools can generate fabricated answers, a human review step is not optional. The difference between low-stakes drafting and high-stakes decisions is worth illustrating with an example each.
5. Sensitive uses. Name the areas where extra oversight or advance approval is needed: decisions about people (such as recruitment or performance), health, legal, security and financial matters. The reasoning is covered in the discussion of why sensitive fields need extra human oversight. Be clear that AI should not be the sole basis for decisions affecting individuals.
6. Transparency. State when AI use must be disclosed, to customers, clients or colleagues, and how. Consider internal practices too, such as noting when a document was drafted with AI help. Guidance on AI disclosure can inform your wording.
7. Quality, fairness and ownership. A sentence or two on checking for bias or unfair outcomes, and on respecting copyright and confidentiality in what you produce and what you input. Questions about content ownership are unsettled in many places, so keep the language careful and seek advice when it matters.
8. Accountability and reporting. Name who owns the policy and who staff can ask. Describe what to do if something goes wrong, such as sensitive data pasted into the wrong tool or a damaging error in published work. An agreed escalation path and a no-blame tone for prompt reporting encourage people to speak up quickly.
9. Consequences and support. Briefly state that serious or repeated breaches may lead to action under normal workplace procedures, and that help is available for those unsure. Keep the tone supportive. Fear tends to produce hiding, not compliance.
10. Review date. AI tools and laws change quickly. Set a regular review, perhaps every six months at first, and note the version and date at the top.
Make it usable
- Add a one-page quick reference with a short list of do’s and don’ts.
- Include a few realistic examples: “Okay: asking an approved tool to tidy the wording of a public announcement. Not okay: pasting a client’s contract into a free online tool.”
- Cover it in staff training and in employee onboarding.
- Put it where people actually look, such as the intranet or shared drive, and tell them when it changes.
Avoid common drafting mistakes
- Blanket bans that people ignore, driving use out of sight.
- Overly detailed rules that go out of date within weeks.
- Vague wording such as “use AI responsibly” with nothing to act on. A general commitment to responsible AI is fine as a principle but needs concrete rules beneath it.
- No owner, so questions go unanswered.
- No link to risk. A short risk checklist helps you decide which rules matter most for your organization.
Test before you finalize
Show a draft to a few staff members from different roles and ask them to apply it to three scenarios. Where they disagree or hesitate, rewrite. Then publish, explain it, and review it on schedule. A policy that is read, understood and updated does more than a thorough one that sits in a folder.