An AI policy should answer a simple operational question: what may people do with AI tools, using which information, under whose approval and with what review?
Define approved tools and accounts
Maintain a list of approved AI services and permitted business purposes. Require business accounts where available and prohibit employees from connecting unapproved AI tools to company email, files, CRM, finance or other systems.
Classify information before use
Do not enter client-confidential information, personal information, credentials, financial details, legal advice, health information, proprietary source code or other restricted material into an AI service unless the specific use, provider terms, retention, training behaviour and security controls have been reviewed and approved.
Require human review
AI output can be inaccurate, incomplete, biased or inappropriate. A qualified person remains accountable for validating facts, calculations, citations, legal implications and client-facing decisions. AI must not be the final decision-maker for hiring, termination, credit, payment, legal, privacy, security or other high-impact decisions without an approved control framework.
Protect intellectual property
Employees should verify whether they have the right to upload source material and whether generated output can be used for the intended purpose. Do not assume that content is safe to publish because an AI system produced it.
Be transparent where it matters
Define when customers, employees or partners should be told that AI materially contributed to an interaction, recommendation or deliverable. Provide a path to human review for consequential outcomes.
Control automation and integrations
An AI assistant that drafts text creates different risk from an agent that can send email, change records, issue refunds or access customer data. Require formal approval, least-privilege access, logging, testing, rollback and human gates before AI is connected to operational systems.
Report problems
Employees should know how to report accidental disclosure, harmful output, suspicious prompts, unexpected agent actions or use of an unapproved tool. The response process should connect AI governance with privacy, cybersecurity and incident management.