If your team already uses AI tools informally, you have an AI policy — it is just unwritten and inconsistent. A one-page policy that people actually read beats a long one nobody opens. Have it reviewed by your own advisers; this guide is general information, not legal advice.
Approved tools and accounts
Name the tools people may use and the type of account. Business plans often have different data terms from free personal accounts; check each provider's current terms yourself rather than relying on summaries.
Data that never goes in
List the specific categories for your business: for example passwords, payment details, client financial records, staff HR files, health information, or anything under a confidentiality agreement. Specific beats vague — 'sensitive data' means different things to different people.
Outputs that always get human review
State which outputs must be checked before use: anything sent to clients, anything with numbers, anything that sounds like advice. A green / amber / red list with examples from your own work makes this concrete.
- Green: internal drafts, brainstorming, summarising your own notes
- Amber: client emails and proposals — draft with AI, a person approves
- Red: legal, tax, HR or pricing decisions — research only, people decide
Incidents and questions
Say what to do if something goes wrong — confidential data pasted by mistake, or an incorrect output sent — and who to tell, the same day, without blame. Name one person people can ask when unsure.
Written and reviewed by The AI Scale Academy team. Guidance is general and educational, not legal, tax or financial advice.