What Belongs in a Small Team's AI Use Policy

Most AI policies fail the same way: they are written to protect the organisation legally, in language nobody reads, and then everyone carries on as before.

A policy people follow is short, specific, and written for the person doing the work.

1. What AI is encouraged for

Start with permission, not prohibition. A policy that only says "do not" reads as disapproval, and people respond by not asking.

Name the things you actively want people using it for, with examples from your own work: drafting first versions, summarising long documents, rewriting for clarity, generating options, explaining unfamiliar material.

2. What must never go in

This is the part that matters, and it must be concrete. "Do not share confidential information" means nothing — everyone thinks their use is the exception.

Name the categories and give examples:

• Client personal data — names, addresses, anything identifying
• Anything under NDA
• Health, financial or legal records
• Passwords, keys, credentials
• Unreleased commercial information

If you have a paid tier with contractual guarantees about training and retention, say which tool that is and that it is the one to use for anything sensitive. People need to know where the safe door is.

3. When a human must check

Be specific about the trigger, not the intent. "Use your judgement" is not a rule.

Anything that goes to a client. Anything with numbers in it. Anything that makes a claim about the law, health, or safety. Anything that will be published.

4. What you tell clients

Decide it, write it down, and be consistent. If a client asks whether you use AI, everyone should give the same answer — and it is much better to have chosen that answer in advance than to improvise it under pressure.

5. Who to ask when unsure

Name a person. Not a department, not an inbox — a person, and a promise that asking is welcome. Most breaches are not defiance; they are someone guessing because asking felt like an imposition.

6. How to raise a mistake

The most important clause, and the one usually missing.

Say explicitly: if you spot that AI produced something wrong and it went out, say so immediately, and nobody is in trouble for raising it. Then honour that the first time it happens.

Without this, people hide errors and you find out from the client.

Keep it two pages

If it is longer, it will not be read. If it is not read, it does not exist.

Write it in plain English. Have someone outside the process read it and tell you what they think it means. Review it every six months, because the tools change fast enough that a year-old policy will name products you no longer use.

A policy is a starting point, not legal advice. If you handle regulated data, have someone qualified look at it.