Does my company need an AI policy?

AI use is already happening at many workplaces, whether or not it is sanctioned. A Microsoft Work Trend Index survey found that 78% of AI users are bringing their own AI tools to work. A policy makes the rules visible and gives people a safe way to use the tools instead of a hidden one.

To write one, start from the copyable company AI policy template, which walks through the decisions, the wording and the rollout.

Why a policy matters

• Data leaves the building. Anything pasted into an AI service goes to a third party.
• Terms differ by account. Personal and business plans are governed by different agreements; see whether Claude trains on your data for one vendor’s explicit distinction.
• Outputs can be wrong. Someone must be accountable for checking.
• Clients and regulators ask. Contracts and questionnaires increasingly ask how you use AI.

What a short policy should cover

1. Approved tools. Name them, and say which accounts (company, not personal) to use.

2. Data rules. Define what never goes in: passwords and keys, regulated personal data, client-confidential material, anything under NDA. Define what is fine: public information and your own drafts.

3. Review requirement. Anything factual, numerical, legal or client-facing must be checked by a person before it is used.

4. Disclosure. When must you tell clients or colleagues that AI was used? Some industries require it.

5. Automation limits. If staff use agent tools that act on files or email, say what they may connect and what needs approval. See what AI agents are.

6. Monitoring and retention. Tell staff what is logged; see whether your employer can see your AI chats.

7. Ownership and questions. Name a person to ask, and a process to request new tools.

8. Consequences and updates. Say who reviews the policy and how often. Tools change quickly; review it at least every six months.

A starter outline

Purpose. Scope. Approved tools and accounts. Prohibited data. Required review. Client and legal considerations. Incident reporting (if something sensitive was pasted, tell X within 24 hours). Owner and review date.

Incident reporting is often skipped and often needed: people make mistakes, and it is better if they report them.

What published frameworks say

• The NIST AI Risk Management Framework is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems. It is a good outline source if you want something more formal than a one-page policy.
• NIST released the Generative Artificial Intelligence Profile on July 26, 2024.
• ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System within organizations. Most small companies do not need certification, but it shows what a full program covers.
• A Microsoft Work Trend Index survey found that 59% of leaders worry about quantifying the productivity gains of AI. That is another reason to record which tools are approved and what they are used for.
• On review rules: Anthropic guidance on reducing hallucinations in Claude says to always validate critical information, especially for high-stakes decisions.

Tips for rollout

• Explain the reasons, not just the rules.
• Give people a good approved tool. A ban with no alternative drives use underground.
• Train people. A policy nobody understands does not protect anything.
• Start with the highest-risk teams (legal, finance, HR, client service).

Not legal advice

Regulated industries and some jurisdictions have specific requirements, so have counsel review your version.

The class

Learn AI Fast’s day-two session covers what never goes into an AI tool, and covers the core elements of a workplace AI policy. For teams, see AI training for teams in Boston.

Sources

• Microsoft and LinkedIn, 2024 Work Trend Index: AI at Work Is Here. Now Comes the Hard Part: “AI users are bringing their own AI tools to work”
• NIST, AI Risk Management Framework: “is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems”
• NIST, AI Risk Management Framework: “On July 26, 2024, NIST released”
• ISO, ISO/IEC 42001 Artificial intelligence management system: “specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System”
• Microsoft and LinkedIn, 2024 Work Trend Index: AI at Work Is Here. Now Comes the Hard Part: “59% worry about quantifying the productivity gains of AI”
• Anthropic, Reduce hallucinations (Claude Platform Docs): “Always validate critical information, especially for high-stakes decisions”