How to Write an AI Use Policy for Your Team

Your staff are already using ChatGPT, Claude, Copilot or Gemini. Some of them are using the free versions on their personal phones. An AI use policy gives them clear rules before something goes wrong, such as a customer list pasted into a public chatbot. Using unapproved tools like this is often called shadow IT, and the AI version has its own glossary entry, shadow AI. Our short answer on whether you need an AI policy covers the basics. This guide is for owners and managers of small and mid-sized businesses. You finish with a one-page policy, a copyable outline and a way to roll it out.

This is general information, not legal advice. Privacy, employment and industry obligations vary, so have a lawyer review the final version if your work involves sensitive data.

Step 1: Find out what people already do

Do not write rules for an imaginary workplace. Ask your team three questions, in a friendly way, with no blame:

1. Which AI tools do you use for work, including free or personal accounts?
2. What do you use them for?
3. What have you pasted into them?

You will learn which tools to approve, which uses are common and where the real risk sits. People who fear punishment will hide their habits, so say clearly that the goal is to write sensible rules, not to catch anyone.

Step 2: Sort your information into three tiers

Most of a policy comes down to what can go into an AI tool. A simple three-tier system works for most small businesses.

Tier	Examples	Rule
Open	Published website copy, public product descriptions, generic questions	Any approved tool
Internal	Internal procedures, draft documents, pricing logic, meeting notes without names	Approved business-plan tools only
Restricted	Customer personal details, health or financial records, passwords, tax file numbers, anything under a client confidentiality agreement	Never entered into AI tools unless the owner has approved a specific tool for that purpose

Under the Privacy Act 1988, businesses covered by it have obligations about how they handle personal information. Whether and how those obligations touch your AI use depends on your size and sector, so treat the Restricted tier as the conservative default and get advice for edge cases. The OAIC guidance on commercial AI products is the regulator's own starting point, and our answers on whether the Privacy Act applies to AI tools and whether ChatGPT is safe for client data explain the basics.

Step 3: Choose the approved tools

List the tools staff may use, with the plan tier. Write the list as a table the whole team can see. Check each vendor's current terms on whether your inputs are used to train models and how long data is kept, because these terms change and differ between free and paid plans.

A short approved list beats a long one. Every extra tool is another set of terms to read and another account to manage. If staff want something not on the list, give them a simple way to ask.

Step 4: Write the rules that matter

Aim for five to eight rules, each a single sentence a person could act on. Good rules are specific:

• Use only approved tools, signed in with your work account.
• Never enter Restricted information.
• Review everything AI produces before it leaves the business. You are responsible for what you send.
• Do not present AI output as a person's own professional judgement where a client expects that.
• Tell the owner if you suspect something sensitive was entered by mistake.

Weak rules say things like "use AI responsibly". Nobody can follow that sentence. The government's Guidance for AI Adoption lists the wider practices behind rules like these. For rules about checking outputs, see our guide to keeping a human in the loop.

Step 5: Name who decides

Pick one person who owns the policy. In a small business that is usually the owner or operations manager. Their jobs are to approve new tools, answer "can I use AI for this?" questions and run the six-monthly review. Without a named owner, the policy has no one to maintain it.

Step 6: Say what happens after a mistake

People will make mistakes. Write the response down: tell the policy owner straight away, do not delete evidence, and the business decides next steps, which may include notifying affected people. Under the Notifiable Data Breaches scheme, some breaches must be reported, so check with an adviser if personal information is involved. A blame-free reporting rule gets problems raised early, when they are still small.

Step 7: Publish it and walk through it

A policy nobody has read does not protect you. Present it in a 15-minute team meeting, use two real examples from your Step 1 answers and ask people to confirm they understand it. Keep it somewhere easy to find, such as the top of your shared drive, and mention it in onboarding for new starters. Our guide to rolling out AI tools to a team covers how to make the habit stick.

Copyable policy outline

Copy this into a document and fill in the brackets.

AI USE POLICY - [Business name]
Owner: [name]   Last reviewed: [date]   Next review: [date]

1. Purpose
   One or two sentences on why we use AI and why we have rules.

2. Approved tools
   [Tool] - [plan tier] - [what it is approved for]
   [Tool] - [plan tier] - [what it is approved for]
   To request a new tool, ask [name].

3. What can go in
   Open: [examples]
   Internal: [examples] - approved business-plan tools only
   Restricted: [examples] - never entered into AI tools

4. Rules
   a. Use approved tools with your work account.
   b. Never enter Restricted information.
   c. Check all AI output before it is sent or published.
   d. [Rule specific to our industry]
   e. [Rule about client disclosure, if relevant]

5. Reviewing AI output
   Customer-facing content is checked by [role] before it goes out.

6. If something goes wrong
   Tell [name] immediately. No blame for prompt reporting.

7. Questions
   Ask [name] before you try something new.

What to do next

A policy is the start. The harder part is getting people to follow it and to use the tools well. If you want help turning a policy into daily habits across your team, AI adoption from 21Labs covers the plan, the rollout and the follow-up. Start with the free discovery on the form below and we reply within 24 hours.