· 4 min read
Write an AI policy your team will actually read
Most AI policies are long and ignored. Here is a one-page version that sorts your data into three tiers and tells people what they may paste where.
A salesperson has a forty-page contract and a meeting in ten minutes. There is a free chatbot open in another tab. She pastes the contract in and asks for a summary.
Your company has an AI policy. It is fourteen pages long and lives in a shared folder. She has never opened it, and right now she has no time to.
The policy did not fail because she is careless. It failed because it cannot be used in the ten seconds when the decision gets made.
People follow rules they can apply mid-task
A rule only works if a person can recall it while their hands are busy. “Use AI responsibly and in line with applicable regulations” cannot be applied to a contract. “Customer contracts go only into the approved tool” can.
So the test for every line of your policy is simple. Could someone apply it in ten seconds, with no one to ask? If not, shorten it or cut it.
Sort by the data, not by the tool
Tools change every month. Your data does not. Write the policy around what people are handling, and name the tools underneath.
Use three tiers:
- Green: public or already published. Your website copy, published prices, a job ad. Any tool on the approved list is fine, and so is any tool you have chosen to allow.
- Amber: internal but not sensitive. Meeting notes, draft plans, internal process documents. Approved tools only, with the settings your company has chosen.
- Red: personal, contractual, or financial. Customer details, contracts, salaries, health information, anything covered by a confidentiality promise. Only the specific tool or tools you have approved for it, or no AI at all.
Three tiers is the point. With five, people stop remembering which is which.
Name the tools and one person to ask
A tier list without tool names leaves people guessing. Add a short table: for each tier, which tools are approved.
| Tier | Approved for it |
|---|---|
| Green | Any tool on the approved list |
| Amber | Tools A and B, company accounts only |
| Red | Tool A with the company settings switched on, or none |
Then put one name and one channel at the bottom. “Not sure? Ask Priya in the AI channel.” A person who can get an answer in a minute will ask. A person who has to file a request will guess.
Say what happens when someone slips
Someone will paste something into the wrong place. What you have written decides whether you hear about it.
If the policy threatens discipline, people hide mistakes, and you find out months later or never. If it says “tell us the same day, and we will help you fix it,” you hear early, when the damage can still be limited.
Put that promise in writing. It is the cheapest control you will ever add.
Test the policy on real cases before you publish it
Write five real situations from your own work. For example: summarizing a customer email thread, rewriting a job ad, drafting a reply that includes a client’s order number, cleaning up a spreadsheet of staff pay, asking for ideas for a team offsite.
Give them to three people who did not write the policy. Ask each to name the tier, without help.
If all three agree on all five, the policy works. Where they disagree, the wording is unclear, so fix that line and test again. This takes an hour and finds more problems than a legal read-through does.
Keep it to one page, and review it every quarter
One page means one page. Put the three tiers, the tool table, the person to ask, and the same-day promise on it. Anything longer belongs in an appendix that almost no one needs.
Set a calendar reminder every three months. Each time, check the tool list, read the questions people asked, and add or fix one line. A short policy that stays current beats a long one that ages in a folder.
If your data includes regulated information, have a qualified adviser check the Red tier before you publish. The one-page format still stands, because the adviser is checking your rule, not replacing it.
A policy is not a document you file. It is a decision you make easy.
If you want help finding where AI is already being used in your company and which controls are missing, an AI Governance Audit maps each action to its control and owner. For the review side of the same problem, read where to put the human in an AI workflow.