How to write a company AI use policy people will actually follow

Core sections

Cover these, in plain language.

1. Purpose and scope: who and what the policy covers.
2. Approved tools and how to request new ones.
3. Data rules: prohibited data types and conditions for sensitive data.
4. Human review: which outputs must be checked and by whom.
5. Disclosure: when to tell customers or colleagues AI was used.
6. Accountability: the person using AI remains responsible for the work.
7. Reporting: how to raise concerns or incidents.

Make it practical

Add examples for each rule: “You may summarise internal meeting notes with [approved tool]. You may not paste customer phone numbers into consumer AI apps.”

Align with law and ethics

Check the policy against data protection obligations such as India's DPDP Act, sector regulations, and recognised principles like the OECD AI Principles.

Review regularly

Tools and risks change quickly. Review the policy every six to twelve months and after incidents.

Policy mistakes

These make policies ignored or harmful.

1. Writing in legal language employees can't apply.
2. Listing prohibitions without approved alternatives.
3. Never communicating the policy beyond an intranet page.
4. Failing to update it as tools change.

A one-page policy structure

Many organisations start with something this short.

AI Use Policy (v1)
1. Approved tools: [list] — request others via [link]
2. Never share: personal data, credentials, confidential client info (unless tool approved for it)
3. Always review AI output before it leaves your team
4. Disclose AI use to customers when [criteria]
5. You remain responsible for your work
6. Questions/incidents: [contact]
Reviewed: [date]