1. Purpose
We use AI to do better work faster. We stay accountable for that work. This policy says which tools we use, what they may see, and who answers for the results.
2. Who it covers
Everyone who works for [Company name], including employees, contractors and owners, whenever AI is used for company work, on any device.
3. Approved tools
Use only the AI tools on this list for company work: [Tool name] for [purpose]; [Tool name] for [purpose]. To request another tool, ask [Policy owner]. Free or personal accounts are not approved for company data.
4. What AI may see
- Never enter: customer or employee personal records, health information, payment or bank details, passwords and access keys, and anything covered by a confidentiality agreement.
- Ask first: contracts, unreleased financials, pricing models and client documents. [Policy owner] confirms the tool is approved for that kind of data.
- Fine to use: public information, your own drafts with names removed, and general questions.
5. Decisions that need a named human owner
AI may inform these. It may not make them. A named person decides, and can explain why: hiring, firing and pay; pricing or credit offered to an individual; legal, tax or compliance statements; medical or safety advice; and anything sent to a regulator, a court or the press.
6. Check before you rely on it
- Confirm facts and figures against a source you trust. AI can sound certain and be wrong.
- Recalculate any numbers that matter.
- Check names, quotes, dates and links.
- Read the whole output. You are responsible for what you send.
7. Clients and the public
Do not let AI act on behalf of the company without a person approving what goes out. If a customer is talking with an AI tool, we tell them so.
8. Records
For work that informs a material decision, keep a short note: the tool, the date, the owner, and what was checked. Keep it with the decision record.
9. If something goes wrong
If sensitive data was entered by mistake, a wrong output was sent, or a tool behaved unexpectedly, tell [Policy owner] within one business day. Reporting is never punished. Hiding a problem is.
10. Training and review
New team members are shown this policy when they start. [Policy owner] reviews it every [six months] and whenever the tools or the law change.
Adopted by: [Name, title] Date: [Date] Next review: [Date]
Want this written for your business?
The policy is the last step of an AI governance review: we find the AI you already use, sort your data, and name owners first, so the rules fit how your people really work.