Whether or not your company has made a decision about AI, some of your team are probably already using it: drafting emails, summarizing documents, checking code, translating text. That is often a good thing. The risk is that people are making their own decisions about what is safe to paste into a chat window.
A short AI policy solves this. It does not need lawyers or twenty pages. One page of clear rules protects your company and gives people the confidence to use AI well.
Why a policy helps
- It reduces real risks, such as confidential data being shared with unapproved tools.
- It removes uncertainty, so careful employees are not afraid to use AI and careless ones know the limits.
- It keeps quality up, by making clear who is responsible for the final work.
What to include
1. Approved tools
List which AI tools may be used for work, and how to request a new one. Where possible, use business plans whose settings match your needs, and check whether your data is used to train models.
2. What data may and may not be shared
This is the most important section. A simple three-level rule works well:
- Fine to use: public information, general questions, and your own non-sensitive drafts.
- Only in approved tools: internal documents and non-sensitive business information.
- Never: passwords and API keys, customer personal data, financial records, health information, unreleased results, and anything covered by a confidentiality agreement, unless an approved system has been specifically set up for it.
3. Human review
State plainly that the person using AI is responsible for the result. Anything sent to customers, published, or used for a decision must be read and checked by a person first. Facts, numbers, quotes, and links need particular care.
4. Where AI should not decide
List areas where AI may assist but must not make the final decision, such as hiring, pay, legal matters, credit, and anything affecting safety.
5. Transparency
Decide when you tell people AI was involved. For example, you might disclose AI chat assistants to customers, and follow any client contracts that require disclosure.
6. Intellectual property
Remind people to respect copyright, to check client contracts before using AI on client work, and to review how your tools handle ownership of generated content. When in doubt, ask.
7. Who to ask, and how to report problems
Name one person or team for questions. Make it easy and safe to report a mistake, such as pasting something sensitive into the wrong tool. Fast reporting matters far more than blame.
A one-page template
Purpose: Help everyone use AI safely and well.
Approved tools: [list], request others from [name].
Never enter: passwords and keys, customer personal data, financial or health data, confidential client material.
Always review: a person checks anything sent, published, or used for a decision.
AI does not decide: hiring, pay, legal, safety, or [other areas].
You are responsible for work you produce with AI.
Questions or mistakes: contact [name] right away.
Last reviewed: [date]
Rolling it out
- Ask how people use AI today, without judgment. The answers show where the policy needs to focus.
- Keep it to one page and write it in plain language.
- Walk through it with real examples in a short team session.
- Review it every few months, because tools and rules change quickly.
This article is general guidance, not legal advice. If your industry is regulated or you handle sensitive data, ask a qualified advisor to review your policy.
The bottom line
You do not need a long document to use AI responsibly. Clear rules about tools, data, and review let your team move faster with less risk.
If you are rolling out AI across your team and want help with the policy and first use cases, see our AI agents and knowledge assistant service or email us.
