A one-page AI policy your staff will actually read
Key takeaways
- Keep it to one page. A long policy nobody reads protects nothing.
- Cover three things: approved tools, what may go into them, and who owns what comes out.
- The person who sends it owns it. AI can draft, but a person checks before anything leaves the business.
Short version: a good AI policy for staff fits on one page and answers three questions: which tools are approved, what may be typed or pasted into them, and who is responsible for what comes out. Write it in plain words, give examples, and look at it again every few months.
Why one page
Long policies get signed and forgotten. Staff need something they can glance at halfway through a task, when they’re wondering whether pasting a customer’s email into a chatbot is fine. If the answer is buried on page nine, they’ll guess.
One page also forces you to decide what really matters. Everything else can be a conversation.
What should an AI policy for employees include?
Three sections, each short enough to read in a minute:
- Approved tools. Which AI tools staff may use for work, and on which accounts.
- What may go in. What information may be typed, pasted or uploaded, and what must never be.
- What comes out. Who checks AI output, and who is responsible once it’s used.
Then one line at the bottom saying who to ask, by name.
Approved tools
List each tool with the account to use. Business accounts, set up and paid for by the business, beat staff using personal ones, because you can see who has access and close it when someone leaves.
Say you run a small shop selling garden planters. Your list might be one general chat assistant on the business account, the AI features already built into your email and documents, and nothing else without asking first.
Add a simple way to suggest a new tool. People will find useful ones. You want to hear about them, not stumble across them later.
What may go in
This is the section that matters most. Write it as short lists, with examples staff will recognise:
- Fine: product descriptions, draft blog posts, your own published policies, general questions, rough notes with names taken out.
- Ask first: supplier price lists, internal figures, anything marked confidential.
- Never: customer names, addresses, phone numbers or order details in a tool that isn’t approved for them; passwords or account logins; card or bank details; anything about a member of staff.
The test to give people is simple: would you be comfortable if this ended up somewhere you can’t see? If not, leave it out, or ask.
Owning what comes out
AI writes confidently whether it’s right or wrong. So the rule is that the person who uses the output owns it, exactly as if they’d written it themselves.
- Check facts, figures and dates against your own records before anything goes to a customer or supplier.
- Read every word of anything that leaves the business.
- Don’t let AI make a decision about money, a complaint or a member of staff. It can draft. A person decides.
This keeps the policy short. You don’t need a rule for every possible use if everyone knows they answer for what they send.
Write it in plain words
Skip the jargon and the formal tone. Short sentences, real examples from your own work, and a line on why each rule exists. People follow rules they understand and work around the ones they don’t.
Before you finalise it, hand it to one person who wasn’t involved and ask them three things: which tool would you use for this, could you paste this in, and who checks this? If they can’t answer from the page, rewrite it.
Keep it current
AI tools change quickly. Put a date at the top and look at the page again every few months, or sooner when someone asks a question it doesn’t answer. Every good question from staff is a line the policy was missing.
If you’re putting AI in front of customers as well as staff, the same thinking applies: decide in advance what it may do on its own. Act, draft or never sets out how.
Want to know which AI tools are worth approving for your business? Grafto’s AI Tools Report works it out from a short questionnaire.
Frequently asked questions
What is an AI acceptable use policy?
A short document telling staff which AI tools they may use for work, what information may go into them, and who is responsible for checking what comes out. One page is enough for most small businesses.
What should AI guidelines for employees cover?
Approved tools and accounts, what may and may not be typed or pasted in, and who checks and owns the output. Add a named person to ask, and a date for the next review.
Is there a free AI policy template for UK businesses?
Templates exist, but a one-page policy written in your own words, with examples from your own work, is more likely to be read. Use a template for ideas, then cut it down to what matters.
Questions, or want a tool we don't have yet? Email hello@grafto.co.uk — a real person replies.