How to write a company AI use policy
Your staff already use AI. Someone pastes a client email into ChatGPT to draft a reply, someone asks Claude to tidy a spreadsheet, someone has an AI note-taker joining calls. Without a policy, each person makes their own rules about what's safe to share and what needs checking. A good AI use policy is short, specific, and written for the people who'll follow it. Here is how I draft one with a client.
On this page
Start from what people already do
Before writing a word, ask. A short anonymous survey or a few conversations will tell you which tools are in use, on which accounts, and for what tasks. You'll find personal free accounts handling company data, browser extensions nobody approved, and a few people doing careful, useful work worth turning into standard practice. A policy that bans what everyone already does gets ignored; one that starts from real use gets followed.
Approved tools and accounts
Name the tools staff may use and the accounts they must use them through. Business and enterprise plans from the major AI providers generally offer terms that personal accounts don't, such as commitments not to train on your data, admin controls, and data retention settings. Read the terms of the plan you choose and write the result into the policy in one sentence. Personal accounts for company work should be off the list.
Include the AI features built into tools you already pay for: the writing assistant in your email suite, the meeting summarizer in your video platform, the AI in your CRM. Each one sends data somewhere, and staff can't tell which are approved unless the policy says.
Data that never goes in
This is the section that prevents the worst outcomes, so make it concrete. List the categories: client confidential information, personal data about customers or employees, health or financial records, passwords and API keys, unreleased financial results, and anything covered by a non-disclosure agreement. Give examples from your own business. "Don't paste the client's contract into a chatbot" is clearer than "protect sensitive information."
Say what to do instead: remove names and identifying details, use an approved enterprise tool for confidential work, or ask before using AI at all.
A human checks before anything goes out
AI tools state wrong facts fluently. Every piece of AI-assisted work that leaves the company, whether a client report, a published article, code in production, or a social post, needs a named person who has checked it and stands behind it. For facts, that means checking against the source, not asking the AI whether it was right. For code, it means review and tests. NIST's Generative AI Profile lists confabulation, its term for confidently stated false content, among the main risks of these systems, and the cure is a human with the time and duty to check.
Disclosure
Decide when the company tells clients and the public that AI was used. Some industries and clients require disclosure; some contracts forbid AI use on their work entirely. Check client contracts and put the answer in the policy. Never use AI to produce fake customer reviews or testimonials; the FTC's rule on consumer reviews, in force since October 21, 2024, treats AI-generated fake reviews the same as any other fake review.
Meetings and recordings
AI note-takers raise a question the rest of the policy doesn't: consent. Some US states require every party's consent before recording a call. Set a rule that the host announces any recording or AI note-taker at the start, and that anyone can ask for it to be turned off. Decide where transcripts are stored and how long they're kept.
Ownership and review
Name one person who owns the policy, answers questions, and approves new tools. Review it twice a year, because the tools change that often. NIST's AI Risk Management Framework, voluntary guidance published in January 2023, organizes the work into four functions: govern, map, measure, and manage. A small company doesn't need the full framework, but the first function, governance with clear ownership, is the part that makes the rest happen.
Keep it to two pages
A policy people read beats a thorough one they don't. Two pages, plain language, with examples from your own work. Put the approved tools list and the never-share list at the top, since those are what people will look up. Train once, with real examples, and repeat when the policy changes.
A starting outline
- Purpose, in two sentences.
- Approved tools, plans, and accounts.
- Data that never goes into an AI tool, with examples.
- Review: who checks AI-assisted work before it leaves.
- Disclosure to clients and the public.
- Recordings and AI note-takers.
- How to request a new tool, and who owns the policy.
For companies weighing AI tools before writing the rules, see my guide to judging an AI vendor's pitch and the one on running AI pilot tests. I draft and train on these policies as AI policy and staff training.