What to put in a staff AI use policy: the main sections

Most staff AI policies need the same handful of sections. You can write each in a few lines. Here's what goes in each one, and what to do if your business is tiny.

The sections, one by one

Purpose and scope. Say why the policy exists and who it covers. Name employees, and decide whether it also covers contractors and casual staff. One short paragraph is enough. Just state your choice plainly.

Approved tools. List the AI tools staff may use for work, and say what to do about free or personal accounts. The reasoning is on the tools page. Australia's privacy regulator cautions against adopting a product just because it exists.¹ That's a fair test for your list.

Data rules. Spell out what must stay out of AI tools. The same regulator notes that privacy duties follow personal details into an AI tool.¹ Examples are listed in the data rules page.

Checking output. Say who reads AI work before it's used, and what they look for. Sample wording is in the review rule.

Customer-facing use. Say when AI may be used with customers and when they're told. The OAIC wants a chatbot that faces the public to be labelled as AI for its users.¹ More in the customer-facing page.

Roles. Name one person who owns the policy and answers questions. The National AI Centre's guidance says accountable people should be named, recorded and made known to everyone.² The UK's cyber security centre suggests managers ask themselves where responsibility for AI security sits.³

Reporting problems. Tell staff what to do after a slip, such as pasting the wrong thing. One question the UK cyber security centre puts to leaders is how they'd respond to a serious incident with a machine learning tool.³ Make it safe to speak up. If people fear blame, they'll hide mistakes.

Consequences. The Australian guidance lists the consequences for people who act outside the organisation's policies as something to write down.² Keep this short and calm. Point to your normal disciplinary process. Employment law differs by country, so check your own government's workplace pages before you attach penalties.

Training and review. The National AI Centre says people who oversee or use AI systems should be properly trained.² Add a date for the next look at the policy, so it doesn't go stale.

One page or five?

The National AI Centre points out that one tool can carry very different risks depending on the use.² So write rules around uses, not just tool names. "Drafting a blog post" and "summarising a client file" are different jobs, even in the same app.

Wording that works

Use short sentences and direct verbs. "Don't paste client names into a chat tool" beats "Personally identifiable information should not be entered into external generative systems."

Give an example for every rule. Staff follow examples faster than principles. And keep a "Who do I ask?" line with a real name on it.

Skip anything you can't enforce or don't plan to. A rule nobody follows teaches staff that the rest can be ignored too. If you'd like a layout to fill in, the template outline lists these sections as headings.