How to Write a Company AI Use Policy Employees Will Actually Follow
How to write a workplace AI use policy for a US company: what to include, a section-by-section outline, data rules, legal touchpoints and rollout tips.
If your company has no AI policy, it still has an AI practice. It is just invisible. Employees are pasting text into chatbots, using AI features built into the software they already have and trying new tools on personal accounts. A good policy does not try to stop that. It channels it: which tools are fine, what data must never go in, when a human must check the output and who to ask. The best ones fit on two or three pages and are written for the people who will use them, not for lawyers.
Why write one now
- Data leakage. Confidential documents, customer records or source code pasted into an unapproved tool may be stored, reviewed or used for training under that tool's consumer terms.
- Accuracy. AI-generated errors in client work, contracts or public statements are the company's errors.
- Legal exposure. Using AI in hiring, lending, housing, insurance or healthcare decisions touches federal anti-discrimination and consumer protection laws, plus a growing number of state and city rules.
- Intellectual property. Questions about who owns AI-assisted work and whether outputs infringe others' rights are still being worked out in US courts and at the US Copyright Office.
- Missed upside. Without guidance, cautious employees avoid useful tools entirely while others take risks unknowingly.
Principles before rules
Open with three or four sentences that tell people how to think, so they can handle situations the rules do not cover. For example:
- We use AI to do better work, faster, and we encourage experimentation within these guidelines.
- You are responsible for anything you produce with AI, just as if you had written it yourself.
- Protect confidential, customer and personal information as carefully in AI tools as anywhere else.
- When in doubt, ask.
A section-by-section outline
| Section | What it covers |
|---|---|
| Purpose and scope | Who the policy applies to (employees, contractors), which tools count as AI |
| Approved tools | The specific products and plans allowed, and how to request a new one |
| Data rules | What may and may not be entered into AI tools, by data category |
| Permitted and prohibited uses | Green-light tasks, tasks needing approval, banned uses |
| Human review | When output must be checked, and by whom |
| Disclosure | When to tell clients, customers or colleagues that AI was used |
| Intellectual property | Ownership, use of third-party content, code licensing |
| High-impact decisions | Extra rules for hiring, performance, credit, health and similar areas |
| Security | Accounts, access, browser extensions, AI agents with system access |
| Training and support | Required training, where to get help |
| Incidents | How to report a mistake or data exposure |
| Ownership and review | Who maintains the policy and how often it is updated |
Data rules: the heart of the policy
Tie AI data rules to the categories your company already uses. A simple traffic-light model works well:
- Green (any approved tool): public information, your own drafts without confidential details, general questions.
- Yellow (enterprise-approved tools only): internal documents, non-public business plans, anonymized data.
- Red (never, unless a specific system is approved for it): customer personal information, Social Security numbers, payment card data, health information covered by HIPAA, student records covered by FERPA, employee personnel files, passwords and credentials, and information under a nondisclosure agreement.
Spell out practical examples. "Do not paste a customer's support ticket with their name and address into a consumer chatbot" is clearer than "do not share PII."
Permitted, restricted and prohibited uses
Generally permitted: drafting and editing internal documents, brainstorming, summarizing non-confidential material, coding help in approved environments, research with source checking, translating internal content for understanding.
Permitted with approval or extra review: customer-facing content, marketing claims, anything published under the company's name, code going into production, customer-facing chatbots.
Prohibited: using AI to make final decisions about hiring, firing, promotion, pay, credit or eligibility without human review and an approved process; generating content that impersonates real people; creating fake reviews or testimonials (the FTC's rule on consumer reviews and testimonials explicitly covers fake reviews, including AI-generated ones); recording people without required consent; bypassing security controls.
High-impact decisions deserve their own section
If AI touches decisions about people, involve legal counsel. Federal anti-discrimination laws enforced by the EEOC, including Title VII and the Americans with Disabilities Act, apply regardless of whether a human or software screens candidates. New York City requires bias audits and notices for certain automated employment decision tools, and several states, including Colorado and Illinois, have passed laws addressing AI in consequential decisions or employment. Requirements and effective dates continue to evolve, so this section should name a person responsible for tracking them.
Human review and disclosure
Define "human in the loop" concretely: who checks what, and against what. For example, every factual claim in client deliverables is verified against a primary source; all AI-generated code passes the same review and tests as human code.
On disclosure, decide case by case and write it down. Many companies disclose AI use when clients have asked about it, when a contract requires it, when a customer is talking to a chatbot rather than a person, or when content could be mistaken for real photos or a real person's voice.
Security rules for newer AI features
Policies written for chatbots can miss newer capabilities. Add a few lines covering:
- Browser extensions and plug-ins that read everything on screen; allow only approved ones.
- AI agents that can send email, edit files or make purchases on someone's behalf; require approval and limit their permissions.
- Connectors that link an AI assistant to company email, drives or calendars; only IT should enable them.
- Personal accounts, which should never be used for company work.
Rolling it out
- Draft with the people who use AI most. They know the real use cases.
- Publish the approved-tools list separately so it can change without reissuing the policy.
- Train in 30 minutes, not three hours. Walk through the data rules with real examples.
- Make asking easy. A named contact or a dedicated chat channel.
- Acknowledge in writing. Have employees confirm they have read it.
- Review on a schedule. Twice a year at minimum.
The federal NIST AI Risk Management Framework is a free, voluntary resource many US organizations use to structure the governance side, and it scales down reasonably well to smaller companies.
Signs your policy is working
People ask before using a new tool. Sensitive data stays out of consumer accounts. Teams share prompts and workflows that work. Mistakes get reported early rather than hidden. If instead nobody can name the approved tools, the policy is too long, too vague or too buried. Shorten it, add examples and say it again at the next all-hands.
Frequently asked questions
Should a company just ban AI tools?
Outright bans are hard to enforce because AI is now built into email, office suites, browsers and phones, and they tend to push use onto personal accounts where the company has no visibility or protection. Most organizations get better results by approving specific tools, setting clear data rules and requiring human review.
Who should own the AI policy?
Usually a small group rather than one department: someone from leadership, IT or security, legal or compliance, HR, and a representative from the teams using AI most. One named person should be responsible for keeping it current and answering questions.
How often should an AI policy be updated?
Review it at least twice a year and whenever you adopt a major new tool, enter a regulated activity or a relevant law changes. AI products add features quickly, so the approved-tools list may need updating more often than the policy itself.
Sources
- AI Risk Management Framework nist.gov
