Here's a quick test. Ask your team, anonymously, whether anyone has pasted work text into an AI chatbot. In most companies the honest answer is "yes, quite a few of us." They're not being reckless. They found a tool that saves them an hour and nobody told them not to.
That's the situation a policy is for. The goal isn't to stop people using AI. It's to make sure the useful habit doesn't leak your customers' data.
Why banning it doesn't work
Some companies react by blocking everything. It rarely holds. People switch to their personal phones and home laptops, and now you have the same risk with no visibility and no guidance. A clear set of rules that lets people use approved tools safely works better than a ban that gets quietly ignored.
What can go wrong
The risks are fairly concrete:
- Data leaving the company. Customer details, contracts, source code or financial figures pasted into a public tool may be stored by the provider, and in some cases used for training, depending on the service and your settings.
- Wrong answers used as fact. A made-up figure ends up in a client report.
- Copyright and ownership questions. Who owns generated text or images, and could they resemble someone else's work?
- Rule-breaking by accident. Some industries have privacy or confidentiality obligations that apply no matter which tool you use.
- Biased or unsuitable output in anything involving hiring, credit or other decisions about people.
What to put in the policy
Aim for one page that a busy person will actually read.
Approved tools. Name them. If a team needs something new, say how to ask. Business versions of AI tools often come with better data terms than free consumer ones, so check what you're paying for.
Data rules. This is the heart of it. A simple three-level split works well: public information is fine, internal information only in approved tools, and anything confidential or personal never goes in. List examples: customer names and contact details, passwords and keys, unpublished financials, legal documents, health data.
Review rules. AI output is a draft. Anything a customer, client or regulator will see needs a person to check it, especially facts, figures and quotes.
Disclosure. Decide when you'll tell clients or readers that AI helped, and follow any rules your industry has.
Decisions about people. Don't use AI alone to decide on hiring, firing, pay or customer eligibility. A human decides.
Reporting. If someone pastes the wrong thing in, they should tell someone quickly and without fear. A mistake reported on day one is a small problem. One hidden for months isn't.
A contact. Name a person or channel for questions, so "I wasn't sure" has an easy answer.
Making it stick
Write it in plain language, not legal English. Give examples of what's okay and what isn't, since "don't share sensitive data" means different things to different people. Run a short session, thirty minutes with real examples, rather than just emailing a PDF.
Make the safe path easy. If the approved tool is clumsy, people will drift to the one that isn't. And keep it alive: tools and rules change quickly, so review the policy every few months.
Check the settings, too
Policy is only half of it. Look at the tools themselves: whether chat history is stored, whether your data is used for training, who in the company can see what, and whether you can turn on single sign-on. Some of the best protection is a setting, not a rule.
Where to start this week
Find out which tools people already use. Write the one-page draft with the three-level data rule at its centre. Test it on two or three colleagues from different teams and fix whatever confuses them. Then share it and ask for feedback. An imperfect policy that's in use beats a perfect one that's still in draft.
