Draft an AI use policy for a small team
Writes a short, practical policy on which AI tools staff can use, what data they can share, and how to check AI output.
Draft an AI use policy for {{COMPANY}}.
AI tools we use or are considering: {{TOOLS}}
Types of data we handle: {{DATA_TYPES}}
Keep it under 600 words, in plain language staff will actually read. Cover:
1. Approved tools, and how to request a new one.
2. Data rules: what can be shared with AI tools, what never can, and examples of each.
3. Checking output: AI can be wrong with confidence; what must be verified and by whom.
4. Agents and integrations: rules for connecting AI to email, files or other systems, including the risk of prompt injection from content the AI reads.
5. Disclosure: when to tell customers or colleagues that AI was used.
6. Who to ask, and what happens if something goes wrong.
Write it as rules plus short examples, not legal language. Add a one-paragraph summary at the top.Example output
Allowed: ChatGPT Team and Claude for work tasks. Never paste: customer personal data, passwords, unreleased financials. Always check: facts, numbers and code before they leave the company. Ask first: connecting AI tools to email or files.
How to use
List the actual DATA_TYPES you handle, such as "customer emails, invoices, health records". Have someone check it against your legal and contract obligations before rolling it out.
Why it works
Concrete examples of allowed and banned data make rules easy to follow. Covering agents and prompt injection matters now that AI tools can read inboxes and files, not just answer questions.