How to write an AI usage policy in 30 minutes

Chances are some of your team already use AI tools you haven't approved. Without a written policy, nobody knows which tools are fine, what information can go into them, or who to ask.

This guide takes you from nothing to a one-page AI policy in about 30 minutes. You need one person to own it, a rough idea of what information your company handles, and an AI assistant to write the first draft.

What you get

• A one-page policy your team can read in two minutes.
• A short list of approved tools, so nobody has to guess.
• A simple red, amber and green rule for what information can go where.
• A named owner and a review date, so the policy doesn't go stale.

Before you start

Set aside 30 minutes and gather three things:

1. A list of the AI tools people already use. Ask in your team chat. People answer honestly when they know the goal is to help, not to punish.
2. A rough list of the information your team handles: customer details, employee records, financial figures, contracts, source code.
3. The name of the person who will own the policy. Choose someone with authority, not just the most enthusiastic person.

Step 1: Ask your team what they use (5 minutes)

Post these three questions in your team chat, then let the answers come in while you do steps 2 to 4:

1. Which AI tools do you use for work, including personal accounts?
2. What do you use them for?
3. What kind of information do you put into them?

Read the answers as information, not confessions. The tools people already use show you where AI saves them time. Your policy should make those uses safe, not ban them.

Step 2: Choose your approved tools (5 minutes)

Pick one or two tools for the whole company. For each one, check three things in the vendor's own documentation:

• Does it offer a business plan with admin controls and one shared company account?
• Do its terms say whether what you type in is used to train models?
• If you will put personal data into it, does the vendor offer a data processing agreement? Under GDPR, a vendor that handles personal data for you acts as your processor, and you need a contract with it.

Write down the tool names and the plan you chose. Ask people to use company accounts for work, not personal ones, so the company can manage access and remove it when someone leaves.

Step 3: Sort your information into three colours (5 minutes)

Give each type of information a colour:

• Green: fine in any approved tool. Public information, text from your published website, and general questions with no company details.
• Amber: approved tools only, never personal accounts. Internal documents, meeting notes, draft proposals and figures with no names attached.
• Red: never goes into an AI tool without a decision from the policy owner. Passwords and access keys, payment card numbers, health information, and personal data about customers or employees that has not been anonymised.

Adjust the examples to your business. A short list with real examples works better than abstract rules.

Step 4: Add three rules (3 minutes)

1. A person checks anything that leaves the company. AI drafts, a person reads and sends. This covers customer emails, proposals, contracts and public posts.
2. A person decides about people. AI can help prepare, but decisions about hiring, promotion, dismissal, credit and performance are made by a person. Stricter rules apply to these uses, for example under the EU AI Act.
3. Ask before adding a new tool. Anyone who wants to try a new AI tool asks the owner first. Agree how fast the owner answers.

Step 5: Let AI write the first draft (5 minutes)

Paste this into your approved AI assistant. Fill in the brackets with your answers from the earlier steps.

Write a one-page AI usage policy for my company, in plain language that an employee with no technical background can read in two minutes.

Company: [company name, what we do, number of employees, country]
Approved AI tools: [tool names and plan]
Owner of this policy: [name and role]
Review date: [six months from today]

Information rules:
- Green (fine in any approved tool): [your green examples]
- Amber (approved tools only, never personal accounts): [your amber examples]
- Red (never, without a decision from the owner): [your red examples]

Rules:
1. A person checks anything AI drafts before it goes to a customer or the public.
2. Decisions about people (hiring, promotion, dismissal, credit, performance) are made by a person.
3. Ask the owner before using a new AI tool.

Use these headings: Why we have this policy, Approved tools, What can go where, Three rules, Who to ask, Review date. Write short sentences and use examples from my business. Do not invent legal requirements. At the end, list any points where I should ask a lawyer or a data protection adviser.

Step 6: Check it, name the owner and share it (7 minutes)

Read the draft once, line by line. Cut what you don't need and check every example against your real business. Put the owner's name and the review date at the top, and share the policy in your team chat.

Then book 15 minutes in your next team meeting to go through it with real examples. "Can I paste this customer email into an AI tool? Which colour is it?"

Guardrails

• This is a starting point, not legal advice. If you handle sensitive personal data or work in a regulated industry, ask a lawyer or your data protection officer to check the final version.
• Don't paste real customer data into an AI tool to write your policy. The prompt above only needs categories and examples.
• AI drafts can contain mistakes. Read the policy yourself before you share it.

How to tell it is working

After a month, ask the team three questions:

1. Do you know which AI tools are approved?
2. Do you know what you must never paste in?
3. Do you know who to ask?

If anyone says no, the policy isn't visible enough. Share it again and build it into onboarding for new starters.

Make it stick

A policy that sits in a folder changes nothing. Three things help:

• Give people a good approved tool. If the company tool is worse than the personal one, people keep using the personal one.
• Walk through real examples in a short workshop, not just the document.
• Review the policy every six months and whenever you add a tool.

This is one of the governance points in What an AI-Ready Business Has in Place.

Want help putting this in place, with the training that makes it stick? Start with an AI Readiness Audit.