How to Write an AI Usage Policy for Your Employees

Why you need a policy and what goes in it

Employees already use ChatGPT, Claude and other services — with or without a policy. Without rules, someone pastes a client contract into a chat, and someone else sends a client text with made-up facts. An AI usage policy does not ban AI; it sets boundaries: what is allowed, what is not and who is accountable.

Minimal structure:

1. Purpose and scope — who it applies to.
2. Approved tools — the list and conditions.
3. Forbidden data — what must never be entered anywhere.
4. Output review — a human owns the result.
5. Disclosure — when to say AI was used.
6. Responsibility and violations — who oversees it and what happens.
7. Review cycle — how often the document is updated.

Approved tools

Create an allowlist instead of trying to list everything forbidden.

• Name specific services and the account type: a business plan often has different data retention and training terms than a free personal account.
• Describe how to get access and how to request a new tool.
• Cover browser extensions, plugins and AI features inside software you already use — they send data too.

Forbidden data

This is the most important section. List categories concretely:

• personal data of customers and employees (passports, phone numbers, addresses, medical data);
• payment data, card and account numbers;
• passwords, API keys, tokens, server credentials;
• trade secrets: contracts, supplier prices, financial reports before publication;
• source code of closed projects — unless a tool is approved for it specifically;
• data clients shared under a non-disclosure agreement.

Give employees a simple rule: if you would not publish it on the company website, do not paste it into an external AI service without an approved tool. Take your country's personal data laws into account.

Output review

AI makes mistakes confidently: it invents facts, links, numbers and legal rules.

• The employee is responsible for the result, not the tool.
• Facts, figures, quotes and links are checked against the original source.
• Code goes through normal review and tests.
• Legal, financial and medical texts are always reviewed by a specialist.

Disclosure of AI use

Define when AI use must be disclosed:

• to customers — when they talk to a bot rather than a person;
• in client deliverables — when the contract requires it;
• within the team — when text or code is mostly generated.

Also settle ownership: who owns the outputs and whether generated images can be used in advertising.

Policy template

AI Usage Policy — [Company]
Effective from: [date]. Owner: [role].

1. Scope: all employees and contractors with access to company data.
2. Approved tools: [list, account type].
   New tools — on request to [whom].
3. Never enter: personal data, payment data, passwords and keys,
   trade secrets, client data under NDA.
4. Review: the employee owns the result. Facts and figures are
   checked against sources, code goes through review.
5. Disclosure: customers know when they are talking to a bot.
6. Incidents: report data leaks to [whom] immediately.
7. Review cycle: [frequency].

How to roll it out

• Discuss the draft with legal, IT security and department heads.
• Run a short training with "allowed / not allowed" examples.
• Name an owner and a channel for questions.
• Review the document regularly: tools and their terms change fast.