Your staff already use AI. Here is a one-page policy to start with

In almost every business, some people are already using AI tools for work: drafting emails, summarising documents, checking spreadsheets. Often they use personal accounts, and often nobody has told them what is and is not acceptable.

That is a risk, but it is also good news. It means your staff have found something useful. The task is to make it safe and consistent, not to stop it.

Why a ban does not work

A ban is rarely enforced and easily ignored. It pushes use out of sight, onto personal phones and free accounts, where you have no say over what happens to the information. A short policy that says yes to sensible use gets far better compliance than one that says no to everything.

The five points a first policy needs

A first policy fits on one page. It should answer five questions.

1. Which tools may we use?

Name them. A business account with one or two approved tools is better than a free-for-all, because business accounts generally come with stronger commitments about how your data is handled. Check the terms of whichever tool you choose.

2. What must never be put in?

Be specific. Typical examples are customer personal details, staff records, passwords, and anything covered by a confidentiality agreement.

3. Who checks the output?

AI makes mistakes and states them confidently. The rule is simple: the person who sends the work is responsible for it, whatever tool helped write it.

4. When do we tell people?

Decide whether customers should be told when AI has been used, and in which situations. There is no single right answer, but there should be one answer across the business.

5. Who do we ask?

Name one person staff can go to with questions and new ideas. Without that, every team makes up its own rules.

After the policy

A policy is the start. The next steps are to give every team the same approved tools, show people what good use looks like in their own job, and review the rules every few months as the tools change. The businesses that get the most from AI are not the ones with the most advanced tools. They are the ones where every team uses the same tools in the same sensible way.