AI Use Policy Starter.

[COMPANY NAME] AI Use Policy

Effective: [DATE] · Review every 90 days · Owner: [ROLE]

1 · Why we have this policy

AI tools can dramatically improve our work — speed, quality, and what we're able to take on. They also introduce real risks around data, copyright, and accuracy. This policy makes the rules clear so we can move fast without breaking things that matter.

2 · Who this applies to

Every employee, contractor, and vendor who uses AI tools while doing work for [COMPANY]. That includes ChatGPT, Claude, Gemini, MidJourney, Copilot, internal AI features in tools we already use, and anything similar that emerges.

3 · Tools you can use

Our approved AI tools are:

• General-purpose AI: [ChatGPT Team / Claude Enterprise / etc.] — provisioned by [IT]
• Image / creative: [approved tools]
• Coding (if applicable): [approved tools]
• Inside existing tools: AI features inside [Notion AI, Slack AI, Google Workspace AI, etc.]

If you want to use a tool not on this list, request approval from [ROLE] before using it on company work.

4 · What you can put in (and what you can't)

Always OK: public information, your own drafts, generic project context, brainstorming, internal questions, learning new topics.

Never OK in public/consumer AI tools:

• Customer personally-identifiable information (names + emails + addresses, financial data, health info)
• Employee personal data (salaries, performance reviews, medical info)
• Confidential contracts, M&A material, board minutes
• Source code that isn't already open source
• Anything covered by NDA
• Anything you wouldn't want printed in tomorrow's newspaper

For sensitive work, use the enterprise/team tier of approved tools (which contractually keeps data out of training). When in doubt, ask [ROLE] before pasting.

5 · How to disclose AI use

You don't need to disclose AI on routine internal work. You do need to disclose AI use when:

• The work is customer-facing and the customer might reasonably want to know (e.g. a "personalized" message that was AI-generated)
• Regulation or contract requires it
• You're producing content where authorship matters (op-eds, court filings, etc.)
• The output makes substantive claims you didn't independently verify

When in doubt: lean toward disclosure. Trust is harder to rebuild than to maintain.

6 · You're responsible for the output

AI is a tool. You are the author. That means:

• Verify factual claims before they leave the company.
• Edit for voice and accuracy — don't ship raw AI output to customers.
• Don't use AI output to make decisions that significantly affect people (hiring, firing, customer access, pricing) without a human review step.
• If something AI-generated harms a customer, the harm is yours and ours, not the AI's.

7 · Intellectual property

AI-generated content created in the course of your work belongs to [COMPANY], same as any other work product. But:

• Don't claim AI-generated work as 100% original human authorship if asked directly.
• Be careful with AI-generated images that mimic specific artists' styles or include trademarked content.
• Don't paste third-party copyrighted material into AI tools as input without permission.

8 · Customer-facing AI features

If our product uses AI in a customer-visible way:

• Disclose it.
• Give customers a way to escalate to a human.
• Don't claim AI capabilities we don't have ("AI-powered" must mean something).
• Engineering and legal must review any new AI customer feature before launch.

9 · Bias and fairness

AI inherits biases from its training data. If you're using AI in decisions about people (hiring, evaluation, customer treatment):

• Don't use AI as the sole decision-maker.
• Audit outputs across demographic groups quarterly if at scale.
• Document your prompts and process so we can debug if something goes wrong.

10 · Reporting issues

If you notice:

• AI tool behaving inappropriately or returning harmful content
• A potential data leak (you or someone else accidentally pasted sensitive info)
• An AI-related customer complaint
• A coworker using AI in a way that violates this policy

Tell [ROLE] within 24 hours. No blame for honest mistakes — fast reporting protects everyone.

11 · Training

Everyone using AI for company work completes a 60-minute AI orientation within their first 30 days. We refresh quarterly. The orientation covers: approved tools, what not to paste, disclosure rules, and current prompt patterns we recommend.

12 · Policy violations

This policy is meant to enable smart, responsible AI use — not to trip people up. We'll respond to violations proportionally:

• Minor / first time: conversation + training refresh.
• Repeated / careless: manager involvement + formal documentation.
• Egregious / data exposure: standard disciplinary process. Could include termination.

We will not punish people for honest mistakes reported quickly. We will respond seriously to hidden, repeated, or willful violations.

13 · Changes to this policy

AI tools change fast. This policy is reviewed every 90 days and updated when needed. Material changes are announced in writing with at least 14 days' notice.

Acknowledged by: [NAME] · Date: [DATE] · Questions: [EMAIL]

30 minutes to your v1.

1. Search the bracketed placeholders. Fill them in with your specifics. (10 min)
2. Read Section 3 carefully. Match it to the tools you've actually decided on. Don't list tools nobody will use. (5 min)
3. Customize Section 4. The "never OK" list above is generic. Add anything specific to your industry — PHI for healthcare, MNPI for finance, etc. (10 min)
4. Send to legal for review. Frame it as "we'd like to adopt this, what should we change?" — that gets faster review than a blank brief. (~1 week)
5. Communicate it. All-hands or written brief, not just dropped in the handbook. Adoption requires acknowledgment. (15 min)