How to write an AI use policy your staff will actually follow

Why you need one now

Staff are already using AI, whether or not the business has decided anything. Some use it on personal phones, some through free accounts, some through features that quietly appeared inside software you already pay for. Without guidance, each person makes their own judgement about what is safe, and those judgements vary widely.

A policy does not need to be restrictive to be useful. Its main job is to give people confidence: here is the tool we provide, here is what is fine, here is what is not, and here is who to ask. That encourages good use and reduces the chance of a privacy breach, an embarrassing error sent to a client or confidential information leaking into a public tool.

Section one: approved tools

List the AI tools staff may use for work and how to access them, such as a business plan tied to company sign-in. Say clearly that personal or free accounts must not be used for company or client information. Explain how to request a new tool, and that AI features inside existing software count as AI tools too, so the same rules apply to an AI summary button in your CRM. Keep this list short and current. If the approved tool is hard to reach or nobody has been given a licence, people will use whatever is easiest, and the policy becomes fiction.

Section two: information rules

This is the heart of the policy. Define what must never go into an unapproved tool and what needs extra care even in an approved one. Use your own categories: client names and contact details, health information, financial records, IRD numbers, staff HR and payroll details, passwords, commercially sensitive pricing and anything covered by a confidentiality agreement. Give two or three examples of what is fine, such as asking for help structuring a generic proposal or rewriting a public website paragraph.

Tell people how to anonymise. Replacing a name with Client A and removing account numbers often makes a request safe. Add a line reminding staff that the Privacy Act 2020 applies to personal information however it is processed, including through AI, and that a quick question to the policy owner is always better than guessing when information falls into a grey area.

Section three: checking and responsibility

State plainly that the person using AI is responsible for the result, exactly as if they wrote it themselves. Then say which outputs need checking before use: anything sent to clients, anything involving money, contracts, legal or regulatory matters, health and safety, and anything published under the company's name. Explain that AI can produce convincing but false information, including invented references. Decide your position on disclosure. Some businesses tell clients when AI has been used in their work, some only for certain deliverables, and some professional bodies have their own expectations. Whatever you decide, write it down so staff answer client questions consistently.

Section four: specific uses to allow or limit

Address the situations most likely in your business. Can AI note-takers join meetings, and must participants be told? Can staff use AI to draft job adverts, and who checks them for bias? Are AI-generated images allowed in marketing? Can AI be used to screen job applicants or make decisions about people? For most small businesses, decisions about people should stay with people, with AI at most offering a draft for a human to weigh. Also mention security. AI tools can be used to make scams more convincing, so staff should verify unusual requests through a known channel regardless of how genuine a voice or message seems.

Writing, launching and maintaining it

Draft the policy with input from a couple of staff who use AI, so it reflects real work. Keep the language plain and avoid legal jargon unless your adviser insists. Launch it in a short team meeting, show the approved tool working, walk through the examples and invite questions. Ask everyone to confirm they have read it and store that record.

Put a review date on the front page. AI tools, vendor terms and legal guidance change frequently, and a policy written today will be partly out of date within a year. Revisit it every six months or when you introduce a new AI product, and update the examples as you learn which situations actually come up.

Name one person as the policy owner. In a small office that might be the operations manager or a director, supported by whoever looks after your IT. Their job is not to police every prompt but to answer questions, approve new tools, keep the approved list current and notice when the rules no longer match how people work. A policy without an owner tends to be forgotten within months.