An AI usage policy your staff will actually read.
Copy it, adapt it, adopt it.

1. Why this policy exists

AI tools make parts of our work faster and better, and we encourage using them well. They also make it easy to send business and client information to systems we don't control. This policy exists so everyone knows which tools are approved, what can and can't go into them, and what to do when something goes wrong. It applies to everyone who works for [BUSINESS NAME], including contractors, on any device used for work.

2. Approved tools

The following AI tools are approved for work use, on business accounts only:

• [e.g. Claude, Team or Enterprise plan, signed in with your work account]
• [e.g. Microsoft 365 Copilot, via your work Microsoft account]
• [Add or remove tools to match your rollout]

Anything not on this list is not approved for work information. If a tool would help you, ask [OWNER] – the list is meant to grow, and asking takes a day, not a committee.

3. Accounts

• Work use of AI happens on work accounts. Never use a personal AI account for work information, even once, even if it's faster.
• Sign in with your work identity (single sign-on) where it's offered.
• Don't create new AI accounts with your work email without approval – approved tools are set up for you.

4. What must never go into any AI tool

• Passwords, access keys or anything used to log in to anything.
• Payment card numbers, bank account details, or government identifiers (TFNs, Medicare numbers, licence numbers).
• Health information about any identifiable person.
• Anything a client has told us in confidence that identifies them, unless the tool is on the approved list and [OWNER] has confirmed client data is permitted in it.
• Anything covered by a specific confidentiality obligation (contracts, disputes, sensitive HR matters) without approval.

5. Using AI output

• You are responsible for what you send, publish or act on – "the AI wrote it" is not a review process.
• Check facts, figures, names and anything with legal, financial or safety consequences before it leaves the business.
• Don't present AI-generated work to a client as something it isn't. Where disclosure matters in our industry, follow [INDUSTRY-SPECIFIC RULE, IF ANY].

6. When something goes wrong

If work or client information ends up in an unapproved tool or a personal account – yours or anyone's – tell [OWNER] the same day. The goal is fixing it fast, not blame; the only career-limiting move is hiding it.

7. Keeping this policy honest

• [OWNER] reviews this policy and the approved-tools list every 6 months, or when a new tool is adopted.
• New starters get this policy in week one, with a 15-minute walkthrough of the approved tools.
• Questions and "can I use X?" requests go to [OWNER / CHANNEL].