Writing an AI Use Policy Your Team Will Follow
Most AI use policies fail because they are too long or too vague. Here is how to write short, clear rules for employees, with owners, a review step and a plan for shadow AI.
In this article
Your employees are already using AI. Some use chat assistants to draft emails, some use coding assistants, and some paste customer data into a free tool to summarise it. Most of them mean well. Without clear rules, though, good intentions can still put company and customer data at risk.
An AI use policy gives people the guardrails they need. The problem is that many policies are long, vague and ignored. This guide shows how to write a short policy that people actually follow, with clear rules, named owners and a simple way to approve new tools.
1. Keep the rules short and concrete
A policy that nobody reads protects nobody. Aim for a document that fits on one or two pages, written in plain language, with rules people can apply in the moment.
Good rules are concrete. "Use AI responsibly" is too vague to act on. "Do not paste customer personal data into AI tools that are not on the approved list" is clear. Each rule should answer a real question an employee might have on an ordinary day.
Most policies cover a similar core: which tools are approved, what data must never go into an AI tool, when a human must review AI output, how to label AI-generated content where that matters, and who to ask when unsure. Add rules only when they address a real risk in your business.
If a rule cannot be explained in one sentence, most people will not remember it when they need it.
2. Build the policy step by step
Writing the policy is quicker when you follow a simple sequence and involve the people who will live with it.
Find out how AI is used today.
Ask teams which tools they use and for what. A short anonymous survey often reveals more than a formal audit.
Sort the data.
Define simple categories, such as public, internal, confidential and personal data, and say which categories can go into which tools.
Approve a starting list of tools.
Choose tools with suitable data handling terms and enterprise settings, and publish the list.
Write the rules.
Draft the short rules in plain language, using real examples from your teams.
Name the owners.
Decide who approves new tools, who answers questions and who updates the policy.
Train and launch.
Explain the policy in a short session, share examples and make the approved list easy to find.
Involve a few people from different teams in the drafting. They will spot rules that do not work in practice, and they become advocates when the policy launches.
3. Owners, reviews and shadow AI
A policy needs an owner who keeps it current. AI tools change quickly. A tool that was risky last quarter may now offer enterprise controls, and a new tool may appear that everyone wants to use. Review the policy and the approved list on a regular schedule, and after any significant change.
Create a simple review step for new tools. An employee who wants to use a new AI tool fills in a short request: what the tool is, what it will be used for and what data it will see. A named reviewer checks the vendor’s terms, data handling and security, then approves, rejects or approves with conditions. Keep the step fast, or people will skip it.
That brings us to shadow AI: tools used without approval. Banning everything rarely works, because people find workarounds. A better approach is to make the approved route easy, explain the reasons for the rules and offer good alternatives. When you find an unapproved tool, ask why people chose it. The answer often tells you which approved tool is missing.
Finally, connect the policy to your wider governance. If you run an information security management system, link the AI rules to your existing data classification and acceptable use policies. If you are working towards ISO 42001, the policy becomes part of your AI management system. Our practical AI governance framework shows how the pieces fit.
Measure whether it works. Track requests for new tools, questions people ask and incidents involving AI. A rising number of requests is often a good sign: it means people are using the approved route.
If you would like help drafting an AI use policy that fits your teams, our ISO 42001 consulting team is glad to help you get started.