Learn · Professional

Writing Your Company's AI Use Policy

The best AI policy fits on one page, and the second-best policy is almost any policy at all.

Most companies approach an AI policy the way people approach writing a will: everyone agrees it should exist, nobody wants to start, and the absence quietly gets riskier every month. Meanwhile the actual document, done well, is short. An AI use policy is five decisions written down plainly. Everything longer is usually a policy written to be filed rather than followed.

Why a policy beats both extremes

The failure modes on either side are well documented by now. Ban everything and usage moves to personal phones, where the company has zero visibility — the [shadow AI problem](/work/bringing-ai-to-work/), made worse. Say nothing and every employee invents their own rules, which means your most cautious people forgo real value while your least cautious paste customer data into free tools. A short, clear policy beats both, not because paper stops behavior, but because most employees genuinely want to know where the lines are, and will follow lines that are easy to find.

The five decisions

1. Which tools are sanctioned. Name them. 'Approved: the company Claude workspace, Microsoft 365 Copilot' beats any abstract criteria, because the question employees actually have is 'can I use this specific thing.' Include how to request an addition — a policy with no request path teaches people not to ask.

2. What data can go where. This one decision does most of the policy's work, and a three-tier traffic light covers it: public information may be used with any sanctioned tool; internal information only in sanctioned tools under company accounts; confidential information — customer records, personal data, credentials, regulated material — only where explicitly cleared, tool by tool. Tie the tiers to your existing data classification if you have one; invent this simple one if you do not.

3. Where human review is mandatory. The workable principle: AI can draft, humans ship. Anything customer-facing, legally significant, financial, or personnel-related gets human review before it acts or ships, and the reviewer owns the result exactly as if they had written it. Accountability does not transfer to software.

4. What must be disclosed. Decide when AI involvement is stated — in client deliverables, in published content, internally — and write the answer down, whatever it is. This is the line companies most often leave to improvisation, and improvised disclosure decisions are how trust incidents happen.

5. Who owns the policy. A named person or small group that approves tools, answers the questions the document does not, and revises it. Which brings up the only structural rule that matters: date it and revisit it. In a field moving this fast, a policy nobody has touched in a year is a museum piece. Quarterly review is enough.

Say yes to something

A policy that is all restrictions teaches people that the safe answer is to hide. The document lands completely differently when it opens by sanctioning something real: here are the approved tools, here is the [training](/work/rolling-out-ai/), here is who to ask. Guardrails read as support when there is actually a road between them.

The frameworks worth knowing

A small company does not need to implement a governance framework to write the page above. But three names dominate the formal landscape, and knowing what each is for prevents both panic and overspend when they come up:

NIST AI Risk Management Framework — the US standards body's free, voluntary framework for identifying and managing AI risk. The most approachable of the three, and a common shared vocabulary when customers ask how you govern AI. nist.gov/itl/ai-risk-management-framework
ISO/IEC 42001 — the international, certifiable standard for AI management systems. Relevant when you are large enough that customers or auditors ask for certifications; not a starting point for a fifty-person company.
The EU AI Act — not a framework but a law, phasing in through the mid-2020s, with obligations scaled to how risky an AI use is. If you operate in or sell into the EU, someone in your organization should own understanding whether your uses fall into its regulated categories.

For a typical business using mainstream AI tools for ordinary work, the honest summary is: the one-page policy is the urgent part, the NIST framework is useful reading for whoever owns it, and the other two become relevant with scale and jurisdiction rather than on day one.

Where the real risk concentrates

One calibration note that keeps policies proportionate: for most companies the dominant AI risks are prosaic — confidential data pasted into unsanctioned tools, and unreviewed output shipping with someone's name on it. Both are covered by decisions two and three above. Exotic risks get the headlines; the traffic-light table and the humans-ship rule cover the incidents your company is statistically likely to actually have. Write the page, name an owner, and let it grow only as fast as your usage does.

Common questions

What should an AI use policy include?

Five things: a named list of sanctioned tools with a way to request additions, rules for what data classes can enter which tools, where human review is mandatory before output ships or acts, when AI involvement must be disclosed, and a named owner who keeps the document current. Most good policies fit on a page.

Should companies ban AI tools?

Blanket bans mostly relocate usage to personal devices, where the company has less visibility and no control over accounts or data terms. A short policy that sanctions specific tools under company accounts, with clear data rules, provides more actual protection than prohibition.

What is the NIST AI Risk Management Framework?

A free, voluntary framework from the US National Institute of Standards and Technology for identifying, assessing, and managing AI risks. For most businesses it functions as structured guidance and shared vocabulary rather than a compliance obligation, and it is the most approachable entry point into formal AI governance.

Does the EU AI Act apply to companies outside the EU?

It can — like the GDPR before it, its reach extends to organizations outside the EU whose AI systems are placed on the EU market or affect people in the EU, with obligations scaled to the risk category of the use. If you sell into the EU, someone in your organization should own the question; if you do not, it is worth a periodic check rather than immediate action.