An AI use policy should help someone answer a question while they are doing the work: can I use this tool for this task, with this information, and what must I check?
Begin with uses you have actually considered. A broad statement that staff should use AI responsibly gives them little help deciding whether to paste in a customer email.
Show the rule beside the task
Here is a fictional example for a business that has approved one drafting tool for public marketing material. It illustrates the wording, not a policy ready for adoption:
Drafting public marketing copy >Use the company account for our approved writing tool. The current tool and sign-in instructions are listed in the staff handbook. >You may use product information that we have already published. Keep customer records, internal pricing and information about colleagues out of this task. >Before publishing, check product claims against the current product page and check that the wording fits our offer. Ask the marketing manager about anything you cannot confirm. >Ask the marketing manager before using a different tool or adding another kind of information. If you accidentally submit restricted information, tell them straight away so it can be assessed.
This example names the task, the account, the information boundary, the check and a contact. In your version, name the actual approved product and plan, the accountable role and a working contact route. A reference to a tool list only helps if that list is easy to find and current.
Settle the decisions behind the wording
The example’s restrictions suit its fictional purpose. They do not decide whether your business can use customer information elsewhere. Approval depends on the task, the service and the obligations attached to the material. Use the customer-information checklist with whoever handles those decisions.
Include the rules that apply across uses: who may try a new tool, what to do with existing work in personal accounts and how to report a problem. Link to established security, confidentiality and data-protection policies where they already answer the question.
Set checks by consequence. A wrong date in internal notes could affect a deadline; a public typo may be minor. Describe the facts that matter for the actual task.
Test it with someone who did not write it
Give a colleague the draft and a few realistic situations. Ask them whether they can use the tool, what information they can supply and who they would ask when unsure. Watch where they hesitate. Rewrite those parts.
That tests usability. The people responsible for IT, information handling and relevant contracts still need to check the substance. Where employment terms or legal duties are involved, obtain appropriate specialist advice.
Give the policy an owner, a review date and a route for questions. Update it when a tool, task or information arrangement changes. A short guide with clear answers is more useful than a document padded to cover every possible use of AI.
About Jay
I’m Jay Janes, a Practical AI Advisor and founder of Reformat Labs. I write about choosing useful work for AI, checking the results and supporting the people using it.