A Simple Company Policy for Everyday AI Use

Imagine a company where an accountant pastes a draft contract into a public AI tool to simplify the wording. Nobody told her not to, and nobody told her she could. She only wanted to save time.

The problem: "Our staff are already using public AI tools"

People use these tools because they are useful. A ban does not remove the use. It moves it out of sight, onto personal phones and personal accounts.

The risk is not the tool itself but what gets typed into it. Once company information is pasted into a public service, you no longer control where it goes.

What it costs

• Leaked information: contracts, customer details or prices shared without anyone deciding that they should be.
• Silent workarounds: staff use personal accounts and phones because the approved option is missing or slow.
• No visibility: management cannot see which tools are used or what they are used for.
• Unchecked output: text written by AI reaches a customer without anyone reading it carefully.

The turning point: a short policy and a safe route

A policy works only if people can follow it easily. Keep it to one page and pair it with an approved route, so that following the rule is easier than breaking it.

Here is a one-page version you can adapt to your company.

1. What may be shared. General questions, information that is already public, and drafts that contain no company or personal details.
2. What may not be shared. Personal details of customers or staff, contracts, prices that are not public, financial results, passwords, and anything marked confidential.
3. Which tools are approved. A short named list kept by the company. The approved route is the default, and any other tool needs permission first.
4. Who to ask. One named person or team answers questions, and staff are told that nobody will be blamed for asking.
5. Who checks the output. Any AI-written text that leaves the company is read by a person who takes responsibility for it.

A policy alone leaves a gap. If the approved route is slower than the public tool, people will go around it.

So the company needs a controlled route: one approved place where staff use AI, with access set by role, usage visible to management, and sensitive requests kept on approved paths. In practice this is a controlled layer between your staff and the AI models.

What changes

Staff know what they may do and who to ask. Management can see how AI is used. The rule stops being a ban and becomes a service people want to use.

A rule people can follow beats a rule people work around.

What this means for your company

Start by writing the one page, naming the person to ask, and finding out which tools your people already use. Then decide what the approved route should be.

This is the work covered by my AI governance & model gateways service: a controlled layer between applications and AI models. It offers a choice of commercial and open models, access control, usage visibility and cost control. It is the same approach I apply in the AI solutions I have delivered for large enterprises and public-sector organisations over the past year.

If this sounds familiar and you would like to talk it through, the WhatsApp button on this page is the quickest way to reach me.