Writing an AI policy your team will actually follow

If you haven't asked your team whether they use AI at work, the answer is almost certainly yes. Someone is using it to draft emails, someone else to clean up a spreadsheet, and someone is pasting meeting notes into a free chatbot to get a summary. None of them are doing anything wrong on purpose. They just don't have any rules to follow.

That’s what an AI use policy is for. It doesn’t have to be long or legal-sounding. It needs to be short and clear enough that people actually use it.

I’ve put together a sample policy that follows this article, as a Word file you can edit. You can get it at the end of this article.

Don’t start with a ban

It’s tempting to say “no AI until we figure this out.” I understand why, but it doesn’t work. The work doesn’t stop. It just moves to personal phones and personal accounts, where you can’t see it and can’t control it. A ban mostly guarantees that the AI use you can’t see is the only AI use you have.

A better goal is to move that use somewhere safe and give people clear answers.

What the policy needs to answer

Keep it to one or two pages. If it’s longer, nobody will read it. It should answer the questions people actually have.

Which tools can I use? Name the approved tools and say which accounts to use. For anything work-related, that should be company accounts only, never personal ones. Explain how to request a new tool and roughly how long approval takes. If the honest answer is “a few months,” expect people to work around it.

What can I put in them? This is the most important part, and a simple three-level list works well:

Change the examples to fit your business. A law firm, a medical practice and a marketing agency will put the lines in very different places.

Do I need to check what it produces? Yes, and the policy should say so plainly. AI can be confidently wrong. Whoever uses it for a piece of work is responsible for that work, exactly as if they’d written it themselves. Anything that goes to a client, carries legal or financial weight, or affects a decision about a person should be reviewed by a human first.

Do we tell clients? Make this decision once, as a business, rather than leaving it to each person. Some clients want to know when AI was involved, and some contracts require it. Write down your default.

Who do I ask? Name a person or a shared mailbox. When the policy doesn’t cover something, people need a quick answer, or they’ll guess.

The policy is the easy part

A policy only works if following it is easier than ignoring it. Two things make the difference.

First, the approved tool has to be good. If the company’s tool is clunkier than a free one, people will quietly keep using the free one.

Second, set the tool up so the safe choice is the default. That means turning off training on your data, setting sensible retention, controlling sharing, and connecting sign-in to your company accounts. That way people don’t have to remember the rules for most of it, because the settings already match them.

Training doesn’t need to be a big event either. Ten minutes showing someone how to do their weekly report safely with AI will do more than an hour of slides about principles.

Rolling it out

Start by asking the team, openly and without blame, which AI tools they use and what for. You’ll learn where the real needs are, and people are much more likely to follow rules they had some part in shaping.

Then publish the policy and the approved tool at the same time. A policy with no approved tool is just a longer way of saying no.

After that, look at it again every few months. The tools change quickly, and your use of them will grow. Update the approved list and the examples as you go.

If you work with health, financial, legal or government data, or have client contracts with data rules, check those requirements when you write your “Never” and “Ask first” lists. This article is general guidance, not legal advice.