Sooner or later someone in HR or operations asks the same question: "What are our people allowed to do with AI tools?" In many companies the honest answer is that nobody has written it down. Staff guess. Some avoid the tools out of caution, and others paste customer emails into a free chatbot because nobody said not to.
This article is for the person who has to fix that: a head of HR, operations or a similar function. It is about the writing process and the shape of the page, not about the legal text. If you want a ready outline of the sections, see our one-page acceptable use policy for employees. If you are looking at company-wide oversight, start with the practical AI governance guide for growing companies. Here the goal is smaller: a page that people read, remember and use.
Start by asking, not by drafting
A policy written in isolation tends to describe the company the author imagines. Spend a week finding out what is really happening.
- Ask five to eight people from different teams what they use AI tools for. Make clear that this is not an audit and nobody is in trouble.
- Ask what they were unsure about. "Can I paste this?" is the most common question, and it tells you what the page must answer.
- Ask which tools are already in use, including ones people pay for themselves.
You will usually find two things: more use than expected, and mostly harmless use. That matters, because the page should support the harmless majority and stop only the risky few.
Three groups instead of a long list
Long lists of rules are skimmed and forgotten. A short page with three groups is easier to remember and easier to check.
| Group | What it means | Examples from daily work |
|---|---|---|
| Fine | Use freely, no need to ask | Drafting a neutral email, summarising a public article, brainstorming names for an internal project, fixing the tone of your own text |
| Ask first | Allowed only after a quick question to the named contact | Using a tool for a task involving customers, trying a tool that is not on the approved list, using AI output in material that leaves the company |
| Never | Not allowed in any tool unless the company has set it up for this purpose | Passwords and access keys, personal data of customers or colleagues, contracts under confidentiality, health or salary information |
Choose examples that match your own company. A person in finance should recognise a finance example, and a person in support should recognise a support one. Abstract words such as "sensitive information" mean different things to different people, so back each one with a concrete case.
Say who to ask and how to report a mistake
The page fails if a person who is unsure has nobody to turn to. Put two things at the bottom, in plain words.
- A named person or a shared mailbox for questions. Promise an answer within a working day, and keep that promise. If answers take a week, people stop asking and go back to guessing.
- A simple way to report a mistake. Someone will paste something they should not have, or send a text with an invented fact in it. Say clearly that reporting quickly is expected and is not punished. What you want to learn is what happened and what was exposed, so that it can be fixed early.
Keep the report short: what was done, in which tool, and what information was involved. A form with three fields is enough.
Remind people who is responsible for the result
AI tools write fluent text that can be wrong. One sentence on the page should say that the person who sends or uses a result is responsible for it, whatever tool helped to produce it. Add one practical habit: check names, numbers and claims against a real source before they go to a customer or into a decision.
Keep it to one page
One page is a discipline, not a slogan. If the text does not fit, you are probably describing procedures that belong somewhere else, such as a tool approval process or a supplier review. Link to those from the page if they exist and let the page itself stay short. Use headings, short sentences and the three groups above. Read it aloud to a colleague who was not involved. If they stumble, rewrite that part.
A short example
A mid-sized company asks six people from sales, support, finance and HR to spend an hour on a draft. The group finds that support staff paste customer emails into a chatbot to get reply suggestions, and that nobody knew whether this was allowed. The page puts "customer emails and names" under "Never" for general tools, adds "reply drafts without customer details" under "Fine", and names the operations manager as the contact for a possible approved tool. Staff recognise their own situation in the examples, and the number of questions to the contact in the first month shows where the page is still unclear.
Rolling it out and keeping it current
Publish the page where people look for company information, and mention it in the next team meetings. A five-minute walk-through with the three groups is worth more than a long email. Give new employees the page on their first day.
Then set a review date. Tools change faster than most company documents, so once a quarter is a sensible rhythm for a first year.
- Look at the questions and reports since the last review and add the examples that were missing.
- Ask the same group of users what has changed in how they work.
- Move items between the groups if your situation has changed, for example when an approved tool becomes available.
- Tell staff what changed in two or three sentences and put the new date on the page.
If nothing changed in a quarter, say so and keep the date. It shows the page is looked after.
What to avoid
- Copying a template without changes. Staff can tell when the examples do not match their work.
- Banning everything. A blanket ban pushes use out of sight, where you cannot help.
- No owner. A page with no named contact becomes outdated within months.
- Writing only for managers. The people who must follow the page should be part of writing it.
What to do this week
Pick five people from different teams and ask them the three questions from the start of this article. Write down the examples they give. Sort them into fine, ask first and never, and add a named contact. That draft is already most of the page. Check it with your data protection contact or legal adviser before you publish it, because specific legal requirements depend on your country and sector.
Sources
- Our related articles linked above.
- The three-group structure, the quarterly review and the example are a general working approach, not a standard; adapt them to your company and to any legal requirements that apply to you.