An AI usage policy that fits on one page
Long AI policies don’t get read. One page with clear yes and no answers does more.
I’ve seen AI policies that run to twenty pages. Nobody reads them, so people keep doing what they were doing. A one-page version that answers the real questions works better. Here’s the shape I use:
- Approved tools: the one or two AI services the company pays for, and how to get access.
- Never put in any AI tool: passwords and keys, ID and card numbers, health data, client data unless the contract allows it.
- Always check: facts, numbers, names and code before they go to a client or into production. You’re responsible for the output.
- Say so: when content sent to clients was mainly AI-written, if the client expects to know.
- Ask first: before connecting AI tools to company email, files or systems.
- Who to ask: one named person.
Review it every six months. The tools change faster than the policy.