AI Usage Policy

An AI usage policy is the internal document telling staff which AI tools they may use, for what work, and what may never be pasted into one. It faces inward, which is what separates it from a vendor's acceptable-use terms: the vendor's document restricts what you may do with their service, and yours restricts what your people may do with anyone's. The useful version is short and specific. It names the approved tools rather than describing a category, because "an enterprise-grade assistant" is not something an employee can act on at nine in the morning. It states clearly what classes of data are off limits — customer records, credentials, unreleased financials, anything covered by a confidentiality obligation — using the same labels as the organisation's existing data classification, not a new vocabulary invented for AI. It also has to say what happens to output, which is the half most policies skip. Whether AI-assisted code needs review before merge. Whether a draft sent to a customer needs a human read. Whether generated material can be published without disclosure. Staff generally understand that input carries risk; the risk that a plausible, wrong answer travels onward unchecked is less obvious and needs stating. A policy fails in a predictable way: it is written restrictively, published once, and then ignored, because the work it forbids is work people still have to do. If the approved list contains nothing that does what a team needs, that team will use something else on a personal account, and the organisation loses both the control and the visibility. A route for requesting a new tool, with a real response time, does more for compliance than a longer prohibited list. Treat it as a living document with an owner and a review date. Models, vendors and features change often enough that a policy written a year ago will name tools that have been retired and be silent about capabilities that did not exist when it was drafted. Pair it with training that shows the failure modes rather than only reciting the rules — people follow a rule they understand the reason for.