One page is enough for an AI policy, and one page is all that will be read. This is a template. Everything in square brackets is yours to fill in.
How we use AI at [Company]
We want people here to use AI tools well. They save time on drafting, summarizing and first-pass research, and we would rather you used them openly than in private. This page says what is fine, what needs care, and what is not allowed, so nobody has to guess.
Tools you can use
For general work (writing, summarizing, research, code): [named tool], [named tool]. These are the tools we have agreements with. If you want to use something else, ask [named person] first; the answer is usually yes once we have checked where the data goes.
What you can put into them
Anything you would be comfortable putting in an email to a supplier: drafts, general questions, public information, your own notes.
What needs care
Internal documents, plans, pricing and anything about how the business runs: fine in [named tool] under our agreement, not in free or personal tools. If in doubt, remove names and figures first.
What is never allowed
Customer personal data (names with contact details, addresses, payment information). Anything under a confidentiality agreement. Passwords, keys, or access details. Financial records. None of this goes into any AI tool, including the approved ones, without [named person] confirming the specific case.
When AI helps produce something we rely on
If AI helped write code, a contract, a report or anything a customer will see or the company will act on, a person checks it before it is used, and that person’s name goes on it. AI-assisted is fine. Unreviewed is not.
Where to ask
[Named person], [contact]. Questions are welcome and there is no wrong one. If you have already done something this page says not to do, tell us; the fix is usually easy and nobody is in trouble for asking.
Reviewed [date]. Next review [date six months later].
Notes on using the template
Name the tools.
A policy that says “approved tools” without naming them is a policy that makes every person decide for themselves.
Name a person, not a department. And make sure they answer within a day.
The policy fails the first time a question goes unanswered and someone decides to guess.
Do not skip the "when AI helps produce something" section.
It is the one companies skip and the one that matters most. It is the human-in-the-loop rule, and it is what a customer, an auditor or a lawyer will ask about.
Brief it in person.
A half-day session for the leadership team and then for everyone, using the company’s own tasks, does more than the page. The page is what people check afterwards.
Changelog
- 2026-09-05: first version.
- 2026-09-08: notes on the template collapsed; short version added.