How to write an AI policy for your staff

Your staff may already be using AI tools, with or without permission. A short, clear policy helps them use AI well and lowers the chance of a costly mistake. It doesn’t need to be long. A single page people actually read is better than twenty pages they don’t.

What to include

1. Why you have the policy. Explain that you want people to use AI safely, not that you want to stop them.

2. Approved tools. List the tools people can use and which account type. A business plan may handle your data differently from a free personal account, so check the terms.

3. What can’t go in. Be specific:

• Customer personal information.
• Staff records.
• Passwords, keys and access details.
• Confidential contracts and commercial information.
• Health or financial details.

4. Checking the output. Staff are responsible for what they use. AI can make things up, so facts, numbers, quotes and legal statements need checking.

5. Where a person must decide. List decisions AI can’t make alone, such as hiring, firing, credit, or anything with serious effects on someone.

6. Telling people. Explain when customers or colleagues should be told AI was used.

7. Copyright and ownership. Ask staff to check material before publishing it, especially images and long passages of text.

8. Reporting problems. If someone pastes the wrong thing into a tool, they should report it quickly without fear. Small mistakes are easier to fix early.

9. Who to ask. Name a person, and set a date to review the policy.

Make it practical

Give examples from your business. “Don’t share confidential information” is vague. “Don’t paste a customer’s email into a personal ChatGPT account” is clear.

Roll it out properly

• Talk it through at a team meeting.
• Show people the approved tools and how to use them.
• Ask what they’re already using, without blame.
• Update it as tools change.

If you ban AI outright, people may just use it on their personal phones, where you can’t see it. Providing an approved option is usually safer.

Get advice where needed

Your obligations depend on your business, including whether the Privacy Act applies. This guide is general information, so speak to a legal adviser about your situation.

Our AI security service can review how your team uses AI and help you put practical rules in place.