How to Write an AI Use Policy for Your Employees (With a Starter Outline)

Here’s a safe assumption: some of your employees are already using AI at work. They’re pasting emails into ChatGPT to clean them up, summarizing documents with Gemini, or asking Copilot to draft a proposal. Most of them mean well. Some of them are putting customer information into tools you’ve never reviewed.

That’s not a reason to panic, and it’s not a reason to ban AI. It’s a reason to write down a few clear rules. A short, practical AI use policy protects your business and your customers, and it tells your team that using AI well is welcome.

This post explains what a good policy covers, gives you a starter outline you can adapt, and covers how to make it stick. One caveat up front: I’m not a lawyer. If you’re in a regulated industry (healthcare, legal, financial services, insurance) or handle sensitive personal data, have your attorney or compliance advisor review your final version.

Why You Need One Now

• Your data is already going somewhere. Free and personal AI accounts may use what people type to improve their models, depending on the settings. Business accounts generally don’t, but only if people use them.
• Your team wants guidance. Many employees are unsure what’s allowed, so they either avoid useful tools or use them quietly.
• Mistakes reach customers. AI writes confidently, even when it’s wrong. Someone has to check before anything goes out.
• Clients, insurers, and partners are starting to ask. Having a policy makes those conversations easy.

Principles of a Good Policy

Before the outline, a few principles:

• Short beats complete. One or two pages that people actually read is better than a detailed document nobody opens.
• Plain language. Write it the way you’d explain it at a staff meeting.
• Specific tools, specific data. “Use good judgment” isn’t a policy. Name the approved tools and the data that’s off limits.
• Permission, not just prohibition. Tell people what they can do. The goal is safe use, not no use.
• Easy to update. Tools change constantly. Keep the list of approved tools in a spot you can update without rewriting everything.

A Starter Outline

Adapt this to your business. Each section should be a few sentences or a short list.

1. Purpose

One or two sentences. For example: “We encourage the use of AI tools to save time and improve our work. This policy explains which tools to use, what information can go into them, and how to check the results.”

2. Who this applies to

Employees, contractors, and anyone else doing work for the business, on company devices or personal ones.

3. Approved tools

List them by name, and say which accounts to use. For example:

• “Microsoft 365 Copilot Chat, signed in with your work account”
• “ChatGPT, using the company Business workspace only”
• “The AI features built into [your CRM / practice management / accounting software]”

Then say what to do about anything not on the list: “If you’d like to use a tool that isn’t listed, ask [name] first.” Also say plainly: don’t use personal AI accounts for company work.

4. Information that must never go into an AI tool

This is the most important section. Be concrete. Typical items:

• Customer or patient personal information (Social Security numbers, dates of birth, health information, financial account numbers)
• Passwords, access codes, and API keys
• Confidential client documents, unless the tool is approved for them
• Employee personnel and payroll information
• Anything covered by a contract or NDA that restricts sharing

If some approved tools are cleared for certain sensitive data (for example, a tool covered by a Business Associate Agreement), say exactly which ones and for what.

5. Information that’s generally fine

Help people use the tools confidently. For example: public information, your own marketing copy, general research, internal drafts that don’t contain the items above, and anonymized examples.

6. Checking the output

• AI output is a draft. A person reviews it before it goes to a customer, gets published, or is used to make a decision.
• Verify facts, numbers, names, dates, and anything that sounds legal, medical, or financial.
• The person who sends it is responsible for it, not the tool.

7. Customer-facing use

Say whether AI can be used in customer communication, and how. For example: “AI may help draft emails and responses, but a person reviews and sends them.” If you use an AI receptionist or chatbot, say who owns it and how customers reach a person.

8. Recording and transcription

Meeting and call transcription tools are useful and easy to misuse. Set rules: tell participants when a meeting is being recorded or transcribed, follow applicable consent laws, and don’t record sensitive conversations (HR, legal) without approval.

9. Intellectual property and originality

Don’t present AI-generated content as someone else’s work. Be careful using AI to create images or copy for marketing that could resemble existing brands or copyrighted material. Check your approved tools’ terms if ownership matters for your work.

10. Hiring and decisions about people

If you use or are considering AI for screening applicants or evaluating employees, require review by a person and talk to your attorney first. Several states and cities have rules about automated decision-making in employment.

11. Reporting mistakes

Make it easy and blame-free: “If you think you put information into an AI tool that you shouldn’t have, or an AI-generated mistake reached a customer, tell [name] right away.” You want to hear about problems early.

12. Who owns this policy

Name a person. Say how often it’s reviewed (every six months is reasonable right now) and where the current list of approved tools lives.

Making It Stick

A policy nobody knows about doesn’t protect anyone. A few things that help:

• Give people a good approved option. If the only approved tool is worse than the free one they use at home, they’ll keep using the free one. Paying for business accounts is often the most effective policy enforcement you can do.
• Walk through it at a staff meeting. Ten minutes, with examples from your own business.
• Share good examples. A few prompts that work well for common tasks get people using the approved tools the right way.
• Turn on the admin controls. Microsoft 365, Google Workspace, and business tiers of AI tools have settings for what’s enabled and who can use it. Use them.
• Revisit it. New tools and features appear every few months.

Common Mistakes

• Banning AI entirely. People use it anyway, just without telling you.
• Copying a big company’s policy. It’ll be long, full of references to departments you don’t have, and nobody will read it.
• No approved tools. A policy that says what not to do but never says what to use doesn’t help.
• Forgetting the software you already own. Your CRM, phone system, and email platform may have AI features turned on by default. Know what they do with your data.
• Writing it and filing it. If nobody owns it, it’ll be out of date in months.

When a Formal Policy Is Overkill

If you’re a very small team where the owner does most of the work, you probably don’t need a formal document. A short conversation and a shared note with three rules (which tool, what never goes in, check before sending) is enough.

Once you have staff handling customer information, though, or you’re in a regulated field, write it down. It doesn’t need to be long.

The Bottom Line

A good AI use policy is short, specific, and practical. It names the tools people should use, lists the information that must stay out, and makes clear that a person is responsible for what goes out the door. Pair it with approved tools that are actually good, and most of the risk goes away.

If you’d like help writing one, or figuring out which tools to approve in the first place, book a strategy session. We’ll look at what your team is already using, what your data requires, and put together a policy that fits your business.