What a simple AI use policy should include

By Change & Learning Solutions · Published 5 November 2026 · All insights

People are probably using AI at work already, with or without guidance. A short policy that people can read in five minutes does more good than a long one nobody opens. Aim for one or two pages in plain English. Here is what to cover.

1. Who and what it covers

Say which tools are approved, and whether personal accounts may be used for work. List the tools by name, and say who to ask about a new one.

2. What people may do

Give real examples: drafting and editing text, summarising public information, brainstorming, preparing meeting notes from material they are allowed to share. Examples are easier to follow than principles.

3. What people must not do

• Enter personal data, client information or anything confidential into a tool that has not been approved for it.
• Share passwords, access keys or commercially sensitive material.
• Pass off AI output as checked fact, or use it for a decision about a person without a human review.

4. Checking the work

The person who uses the output is responsible for it. Ask people to check facts, figures and references, and to say where AI helped when it matters, for example in client work.

5. Data: what can go where

A simple three level guide works well: public, internal and confidential. Say which level each approved tool may handle.

6. Who to ask, and how to report a problem

Name a person or a mailbox. Make it easy and safe to say "I think I made a mistake".

7. Review

Tools and rules change quickly. Name an owner and review the policy at least every six months.

Test it before you publish

Ask three people from different teams to explain the policy back to you. Where they struggle, rewrite. This is general information, not legal advice. Check your policy against your own legal and data protection obligations.