How to Write an AI Use Policy Employees Will Actually Follow
Your staff are already using ChatGPT, Copilot and AI features built into the software they use every day. Here is how to write a policy that tells them clearly what is allowed, what is not, and who to ask.
In short
A workable AI use policy names which tools are approved, lists the data that must never be entered into any AI tool, gives concrete examples of allowed and prohibited uses, requires a person to check AI output before it is used, and says who approves new tools. Keep it short, get a dated acknowledgment from every employee, and review it whenever your tools change.
This guide covers the policy your employees follow. If your compliance team uses AI to draft policies themselves, see how to govern AI-assisted policy drafting. For wording tips, see how to write policies in plain language.
Start with scope: which tools does the policy cover?
Most AI policies fail because employees can’t tell whether the tool in front of them counts. Define the scope by how the tool is used, not by brand names alone, because brands and features change every few months.
Approved tools
A short, named list of tools the company has reviewed and pays for or licenses, with the account type staff must use (for example, the company workspace, not a personal login).
Unapproved tools
Everything else, including free consumer versions of approved tools. Say plainly whether unapproved tools are banned outright or allowed for public, non-work-sensitive tasks only.
AI built into other software
Writing assistants in email, meeting transcription, browser extensions and chatbots inside existing apps. These are easy to miss, so name them as in scope.
Data that must never go into an AI tool
This is the section employees most need, so make it a list they can check in ten seconds. Group data into three plain categories and give examples from your own business.
Never, in any tool
Restricted data
Passwords and access keys, customer or employee personal details, health or financial records, payment card data, and anything a contract or NDA says is confidential.
Approved tools only
Internal data
Internal procedures, draft documents, non-public plans and source code. Allowed only in tools on the approved list, using company accounts.
Any tool
Public data
Information already published, such as your public website, press releases or general industry knowledge with no company detail attached.
Write for the moment of decision. Add one rule of thumb employees can remember: “If you wouldn’t post it on the company website, don’t paste it into an unapproved AI tool.” Which data your industry treats as regulated, and what follows if it is exposed, is a question to check with counsel.
Acceptable and prohibited uses, with examples
Abstract rules (“use AI responsibly”) give staff nothing to act on. Concrete examples drawn from real roles do.
Generally acceptable
- Drafting a first version of an email, job ad or presentation outline
- Summarising a long public article or report
- Rewording your own text to be clearer or shorter
- Brainstorming headlines, interview questions or agenda items
Prohibited
- Pasting a customer complaint with the customer’s name and account details
- Making or recommending hiring, firing, pay or discipline decisions with AI alone
- Sending AI-written legal, medical or financial advice to customers unchecked
- Uploading contracts, board papers or personnel files to an unapproved tool
Human review and disclosure
AI tools can produce confident, well-written text that is wrong: invented facts, made-up sources, outdated figures. Make the person using the tool responsible for the result, as if they had written it, and define review: check every fact, number and source, and read the whole output.
On disclosure, decide where it matters. Most organisations don’t require a label on internal emails, but do require it where readers would reasonably expect human authorship or where a customer, regulator or client relationship is involved. Some client contracts and professional rules address AI use directly, so check with counsel for your sector.
A skeleton outline for your AI use policy
Use these sections as a starting structure. Aim for two to four pages; anything longer tends to go unread.
- 1
Purpose and who it applies to
Two or three sentences. Include employees, contractors and temporary staff.
- 2
Definitions and scope
What counts as an AI tool, including features inside other software.
- 3
Approved and unapproved tools
The named list, required account type, and where the current list is published.
- 4
Data rules
Restricted, internal and public categories with examples.
- 5
Acceptable and prohibited uses
Role-based examples, plus decisions that always need a person.
- 6
Review, accuracy and disclosure
Who checks output, what they check, and when AI use must be disclosed.
- 7
Requesting a new tool
Who approves, what information the request needs, and how long a decision takes.
- 8
Reporting mistakes and concerns
Who to tell if restricted data was entered by accident, with a no-blame first report.
- 9
Training, acknowledgment and consequences
Required training, a dated acknowledgment, and a link to your disciplinary policy.
- 10
Ownership and review date
The policy owner, version number and next scheduled review.
Who approves new tools
If the approval route is slow or unclear, employees will use unapproved tools and say nothing. Name one owner, usually IT or security working with compliance, and publish a short request form: what the tool is, what it will be used for, what data it will touch, and who in the team will use it. Have the reviewer check the vendor’s data terms, including whether inputs train its models, commit to a response time, and publish every decision, approved or declined, on the tool list.
Training and acknowledgment
A policy staff have never read protects nobody. Pair the rollout with a short session built on the examples above, then collect a dated acknowledgment from every employee, and repeat it whenever the policy changes materially.
Keeping the policy current as tools change
AI tools change faster than most policies. Set a fixed review cycle, quarterly works for many teams, plus triggers for an earlier review: a new tool approved, a vendor changing its data terms, a reported incident, or new guidance from a regulator. Keep the tool list as a separate page that can be updated without reissuing the whole policy, and record each change with a version number so staff know they are reading the latest one.
That is where policy management software helps. In PolicyTrak:
AI-powered drafting
Describe the policy you need and AI generates a first draft for you to edit. Grammar and quality checks also flag typos and reading level before distribution. Drafts still need human review.
Version control
Every save creates a numbered version with the author’s name and date. Earlier versions can be compared side by side or restored, so frequent updates stay traceable.
Document acknowledgment
Distribute the policy in the app or by email and record each employee’s acknowledgment with a date and time, visible per person and per location.
NotePolicyTrak manages the AI use policy itself: drafting, versions, distribution and acknowledgment. It does not monitor or block which AI tools employees use; that is a job for your IT and security tools.
Roll Out Your AI Use Policy With a Record
Draft, version, distribute and collect dated acknowledgments in one place. Sign up and see plans without booking a call.
