An acceptable-use policy fits on one page

If you have not written an AI policy for your company, your staff have already written one for themselves, one paste at a time. A single page and a short training session close most of the risk.

Why a policy matters even if you have not bought anything

You do not have to roll out an AI tool for your people to use one. Free chatbots are a browser tab away.

Someone in sales pastes a customer email to get a better reply. Someone in finance pastes a spreadsheet to summarize it. Nobody means harm. But company and customer information has now left your control, and you do not know it happened.

Why one page

A long policy does not get read. A short one gets remembered.

Aim for one page that a busy person can read in three minutes. It should answer the questions people actually have.

What goes on the page

1. Approved tools, and what each is for. Name them. “Use the company-licensed assistant for drafting and summarizing internal material” is clear. “Use good judgment” is not.

2. What must never be pasted into any tool. A short list:

• Customer or client personal information
• Passwords, keys, and account numbers
• Anything under a contract or confidentiality agreement
• Unreleased financial results
• Personnel and legal matters

3. Review before you rely on it. AI can be wrong and sound sure. A person checks anything that leaves the building or informs a decision.

4. Be open about it. Say when work was drafted with AI if a customer, regulator, or colleague would expect to know.

5. Who to ask. Name one person. People follow rules when they know where to take a question.

6. How to report a mistake. Make it safe. If someone pastes something they should not have, you want to hear about it the same day, not in six months.

Training matters more than the document

A policy people have never heard is decoration. Plan one short session per team, about thirty minutes, with real examples from their own work.

Show what happens when a prompt includes a customer’s details. Show what a good and a bad request look like. Leave time for questions.

Give it an owner

Someone should own the policy, meaning one named person. Tools change fast, so ask them to review it every six months and after any incident.

A caution

This is a starting point, not legal advice. Contracts, customer commitments, and industry rules can add requirements. Have your attorney read the policy before you roll it out, especially if you handle regulated data.

Where this shows up in the assessment

It is sub-score 3.3, policy and change management, with 3.1, staff skills and AI literacy, in the People & Tool Readiness pillar.

Organizations with no policy are common. It is also one of the fastest gaps to close, usually in a few weeks. If you want to see how yours would grade, read how the assessment works.