Writing an AI policy your team will actually read

Here's the uncomfortable truth: people on your team are probably already using AI tools for work, whether there's a policy or not. The question isn't whether to allow AI. It's whether people know how to use it safely.

Most AI policies I've seen fall into two camps. Some are twenty pages of legal language nobody reads. Others are a single line, "use good judgment," which helps no one. As someone with a background in instructional design, I care a lot about whether people can actually use what we give them. A good policy fits on one page, uses plain language, and answers the three questions people really have:

Signs you need one now

If any of these sound familiar, it's time:

• People are using free AI tools with their personal accounts for work tasks
• Someone asked 'are we allowed to use ChatGPT?' and nobody was sure
• Your organization handles client, donor, student or health information
• Leadership is excited about AI but worried about risk
• You've started paying for an AI tool like Copilot and want people to use it well

The seven parts of a useful policy

Each part below includes example wording you can borrow.

1. Why we use AI

   One or two sentences that set the tone. It reassures people that AI is a helper, not a replacement.

   "We use AI tools to save time on routine work, so we can spend more time with the people we serve. AI supports our work; it doesn't replace our judgment."

2. Approved tools

   Name the tools people can use with work information, and how to request a new one. Business versions of AI tools often come with stronger privacy and data protections than free personal accounts, which is a big reason to standardize.

   "For work, use Microsoft Copilot with your work account. Want to try another tool? Ask Maria first."

3. What never goes in

   The most important section. Be specific. "Sensitive data" is vague; "client names and case notes" is clear.

   "Never enter client or employee personal information, health or financial records, passwords, or documents marked confidential."

4. What needs a check first

   The gray areas, with a simple rule people can follow on their own.

   "For internal plans or partner information, remove names and details first. If you're unsure, ask."

5. A person always reviews

   AI can sound confident and still be wrong. Make review a habit, not an afterthought.

   "Check every AI output for accuracy, tone and fairness before it's sent, published or used for a decision. You're responsible for the final result."

6. Be transparent

   When AI played a meaningful role in something people rely on, say so.

   "Let people know when AI was significantly involved in content they receive, when it matters to them."

7. Who to ask, and when it's updated

   A real name beats "contact IT." And AI changes quickly, so commit to reviewing it.

   "Questions? Ask Maria. We review these guidelines every six months."

Make it memorable: the traffic light

People forget paragraphs. They remember colors. Sort information into three groups and the rules become almost automatic:

Practice: is this OK?

Try these real-world situations. Decide first, then tap to see the answer. (This works great as a 10-minute team exercise, too.)

A one-page template you can copy

Fill in the brackets, adjust the lists for your team, and share it. Keep the language plain. If a sentence needs a lawyer to explain it, rewrite it.

AI USE GUIDELINES — [Organization name]
Last updated: [date] · Questions: [name, email]

1. WHY WE USE AI
We use AI tools to save time on routine work so we can focus on the people we serve. AI supports our work; it does not replace our judgment.

2. APPROVED TOOLS
Use only these tools for work: [e.g., Microsoft Copilot with your work account]. Want to try a new tool? Ask [name] first.

3. WHAT NEVER GOES INTO AN AI TOOL (RED)
- Personal information about clients, donors or employees
- Health, financial or legal records
- Passwords, account numbers or access keys
- Confidential contracts or documents marked confidential

4. ASK FIRST (YELLOW)
Internal plans, partner information, or anything you will publish. Remove names and details when possible.

5. A PERSON ALWAYS REVIEWS
Check every AI output for accuracy, tone and bias before it is sent, published or used to make a decision. You are responsible for the final result.

6. BE TRANSPARENT
Tell people when AI played a significant role in content they receive, when it matters to them.

7. QUESTIONS AND UPDATES
Not sure? Ask [name] before you act. We review these guidelines every 6 months.

Rolling it out so people actually use it

A policy in a shared drive changes nothing. Here's a rollout that works in about two weeks:

1. Day 1Share a draft with a few people

   Ask two or three colleagues to read it and point out anything confusing.

2. Week 1Introduce it live

   Walk through it in a 20-minute team meeting. Use the "Is this OK?" scenarios above; they spark great discussion.

3. Week 1Make it easy to find

   Pin it in Teams or your intranet, and add it to onboarding for new hires.

4. Week 2Collect questions

   Every question reveals a gray area. Add the answers to your yellow list.

Common questions

Want help writing guidelines that fit your team, or running a short training session on safe AI use? Get in touch. And for the bigger picture of bringing AI into your organization, read A human-centered approach to AI implementation.