AI use policy and staff training

A short, enforceable policy for how your company uses AI tools, built from what your people already do, and a training session that makes it stick.

I use AI tools every working day, for research, writing, code, and the build checks behind my own websites, and I've watched what happens when the checking step is skipped. That experience is what I bring to a client's policy: rules that let people get real value from the tools while keeping client data out of the wrong places and keeping a human accountable for everything that leaves the building.

How an engagement runs

1. Discovery. A short anonymous survey and a few conversations to learn which tools staff use, on which accounts, for which tasks, and where the worries are.
2. Tool review. I compare the business plans of the tools you want to keep, read their data terms, and recommend the approved list and account setup.
3. Contract check. I list which client contracts restrict or require disclosure of AI use, so the policy matches what you've already promised.
4. The policy. Two pages in plain language: approved tools, data that never goes in, who reviews AI-assisted work, disclosure, recordings and note-takers, and who owns the policy.
5. Training. A working session with examples from your own business: what's fine, what's off limits, and how to check an AI's output before it goes to a client.
6. Review date. The policy carries a review date of its own, because the tools change fast and a dated policy gets revisited instead of quietly expiring.

The method is laid out in my guide to writing a company AI use policy.

What you get

• The policy, ready to adopt, with a one-page summary for the wall or the intranet.
• An approved tools list with account settings documented.
• A never-share list with examples drawn from your work.
• A review checklist for AI-assisted client deliverables, articles, and code.
• A training session for the team, run on examples drawn from your own work.

Who it's for

Professional services firms, agencies, nonprofits, and growing companies of ten to a few hundred people, where AI use has spread faster than anyone's rules, and where client confidentiality matters. Companies that also need help choosing what to build or buy should look at AI agents and automation and my guide to judging an AI vendor's pitch.

What the policy is built on

NIST's AI Risk Management Framework and its Generative AI Profile, the FTC's rules on endorsements and reviews, the data terms of the tools you choose, and the obligations in your client contracts. For regulated industries, I draft with your counsel, who reviews the final text.

Updated October 26, 2026