Your team is probably already using AI to write emails, summarise documents and draft posts, whether you have approved it or not. That is mostly good. The risk is what gets pasted in: client details, financial data, passwords, private documents.
A one-page policy keeps the benefits and removes most of the risk. This prompt writes one that fits your business and the tools you use.
How to use it
- Decide which AI tools are approved (ideally business plans that do not train on your data).
- Run the prompt and adjust the examples to your work.
- Go through it with the team in ten minutes. Ask what they already use AI for; you will learn a lot.
ai-policy.txt
Write a one-page AI use policy for my business, for non-technical staff. Business: [name], [industry], [team size] Approved AI tools: [e.g. ChatGPT Team, Claude for Work, Microsoft Copilot, Gemini for Workspace] What the team uses AI for: [e.g. emails, social posts, summaries, quotes] Sensitive information we handle: [e.g. client addresses, payment info, health info, children's info] Who to ask with questions: [name/role] Write: 1. Why we use AI (2 sentences, positive). 2. Approved tools and how to get access. 3. Green / yellow / red list: what is fine to put into AI, what needs care (remove names first), and what never goes in. 4. Checking AI work: facts, numbers, tone, and who signs off before anything reaches a customer. 5. Decisions AI must not make on its own. 6. Disclosure: when we tell customers AI helped. 7. What to do if someone pastes something they should not have. Keep it to one page, plain language, practical examples from my industry. Canadian English.
The core rules
- Approved tools only for work data.
- Never paste passwords, payment details, health information or confidential client data.
- A person checks anything that goes to a customer or the public.
- AI does not make final decisions about hiring, pricing, refunds or anything legal.
If you handle health, financial or children's information, or work under a contract with confidentiality terms, have the policy reviewed against those obligations.