A one-page AI usage policy your team will actually follow

Your team is already using generative AI. The question isn’t whether to allow it — it’s whether people have clear guidance. A short, practical policy beats both a ban (which people work around) and a legal document (which nobody reads).

Here’s the shape of one that works.

1. Which tools are approved

Name the specific tools and accounts people should use — ideally an enterprise or business tier where the provider doesn’t train on your data. List them. If someone wants to use something else, they ask first.

2. What can and can’t go in

The clearest way to write this is two short lists.

Fine to put in: public information, draft text you wrote, general questions, your own meeting notes, code you’re allowed to share.

Never put in: customer personal data, anything under NDA, passwords or keys, unreleased financials, HR records, full source code of proprietary systems.

When in doubt, treat it like posting on a public forum — if that would be a problem, so is this.

3. Who’s responsible for the output

The person using the tool owns what it produces. AI output is a draft. It must be checked by someone who knows the subject before it goes to a client, a decision-maker, or into a system. “The AI said so” is not an answer.

That’s it

Add a line on who to ask if unsure, and a date to review the policy in six months. One page, plain language, reviewed regularly. That’s more protection than a ban and more useful than a manual.