Writing an AI use policy your team will actually read

Our first AI policy was four pages long. It had a definitions section. It used the phrase "where operationally appropriate" twice. I was quite proud of it.

Six weeks later I found out that a lovely, well-meaning colleague had pasted a client's entire contract into a free chatbot to get a summary. When I asked whether she'd read the policy, she said — and this is the honest, useful answer — "I skimmed it. I couldn't tell if it was talking about me."

That's the whole problem. A policy nobody can locate themselves in is decoration.

Version two: one page, three lists, one table

Here's the structure we landed on. It fits on a single side of A4 and takes four minutes to read.

1. The one-sentence principle

Ours: "Use AI to do your work better; never give it anything you wouldn't email to a stranger, and always check what it gives back."

If someone remembers nothing else, that sentence carries most of the risk reduction. Write yours before anything else, and make it sound like a person said it.

2. The green list — go ahead, no permission needed

• Drafting internal documents, agendas, summaries of your own notes
• Rewriting or shortening text you wrote yourself
• Brainstorming, naming things, structuring an argument
• Explaining a concept to you (with the caveat that it might be wrong)
• Writing or debugging code on non-sensitive internal projects

3. The amber list — fine, but check with your lead first

• Anything a client will see, in any form
• Anything involving customer data, even anonymised — assumptions about anonymisation are usually wrong
• Setting up a new tool, subscription or integration
• Automating a process that touches money or contracts
• Analysing HR, recruitment or performance information

4. The red list — don't, and come and talk to me

• Pasting anything covered by an NDA or a client confidentiality clause
• Personal data of customers or colleagues into a consumer chatbot
• Any automated decision affecting someone's employment, credit or access to a service
• Generating anything presented as a person's words without telling them
• Using AI output as a legal, medical or financial answer without a qualified human check

5. The approved-tools table

The "who pays" column was an accident and turned out to be brilliant. It quietly killed the shadow-IT problem, because people realised they could just ask for a proper seat instead of expensing a personal subscription.

The four things that made it stick

1. We named a human. "If in doubt, ask Marla" is on the page with my actual name. Policies without a named person become nobody's problem.
2. We wrote it in first person plural. "We don't paste client contracts into chatbots" reads completely differently from "Employees shall not input confidential materials."
3. We included the reason for each red-list item in a half-sentence. People follow rules they understand and quietly route around ones they don't.
4. We promised a no-blame amnesty. Anyone who'd already done something on the red list could tell us in the first month with zero consequences. Four people came forward. All four issues were fixable. Without the amnesty we'd still not know about two of them.

How we rolled it out

No all-hands slide deck. Instead:

• A 20-minute session per team, where we walked through their three most likely amber scenarios. Ten minutes of talking, ten of questions.
• The one-pager pinned in each team's Slack channel and printed by the kettle. Yes, actually printed.
• A quarterly review where the green list gets longer as we approve more things. This is important — a policy that only ever adds restrictions gets ignored within a year.

What we'd do differently

Two things. First, we should have written it before the tools arrived, not four months after. Retrofitting rules onto established habits is much harder than setting them at the start.

Second, we underestimated how much people wanted permission rather than restriction. The most common reaction to version two wasn't "ugh, rules" — it was relief. Several people said they'd been avoiding AI tools entirely because they weren't sure what was allowed. Our policy accidentally increased adoption.

Reference material worth reading

• NIST AI Risk Management Framework — heavyweight, but the risk categories are a good checklist
• ICO guidance on AI and data protection (UK)
• EU AI Act overview — check whether anything you do falls into the high-risk buckets
• Our pilot post-mortem, which covers governance from the failure side

---

Replies (31) — highlights