Insights / Checklist / AI governance, risk and compliance
ChecklistWhat to include in an AI acceptable-use policy
A short, clear policy prevents most early problems with AI tools. It tells staff which tools they may use, what data stays out and who checks the output.
A short policy prevents most early problems with AI tools. Without one, each employee makes their own judgement about which tools to use and what to put into them. Most will be sensible. A few will paste a customer list into a free chatbot or send an AI-drafted contract clause without checking it.
The policy does not need to be long. Two or three pages that people actually read are worth more than a detailed document nobody opens. This checklist covers what to include.
Approved tools
List which tools may be used and for what. Staff need a clear answer to a simple question: can I use this tool for this task? Name the approved tools, the purposes each is approved for and how to request a new one.
- Tools provided by the organisation, with business accounts and agreed terms.
- Tools permitted for general use with public information only.
- Tools that are not permitted, or a rule that anything not listed needs approval.
- How to request a new tool, and who decides.
Data rules
State what data may never be entered, such as personal or confidential information. This is the section that prevents the most serious problems. Be specific: ‘sensitive data’ means different things to different people, while ‘customer names, contact details and account numbers’ does not.
Different tools may have different rules. An approved business tool whose terms prevent your data being used for training may be allowed to process internal documents. A free public tool should usually be limited to information you would be comfortable publishing.
Review and records
Say who checks output and how use is recorded. AI-generated content can be wrong, biased or misleading while sounding authoritative. The policy should make clear that the person using the tool remains responsible for the result, and set extra review for higher-risk uses.
- Every output is reviewed by the person who requested it before use.
- Customer-facing, legal or financial content is reviewed by a second person or the relevant specialist.
- AI is not used to make final decisions about people, such as hiring, without approved process and human decision.
- Significant uses, such as a new automated process, are recorded in a simple register with an owner.
What to leave out
A common mistake is to load the acceptable-use policy with everything related to AI: the organisation’s strategy, technical standards for developers, detailed procurement rules and the full risk framework. Those belong in separate documents for the people who need them. The acceptable-use policy is for every employee, so it should cover only what every employee needs to know.
Avoid vague prohibitions that nobody can apply, such as ‘do not use AI irresponsibly’. Avoid long lists of hypothetical scenarios. And avoid legal language where plain words will do. If a manager cannot explain a rule to their team in a sentence, rewrite it.
Instead, link to the supporting material from the relevant section, so people who need more detail can find it without everyone else having to read it.
Making it stick
A policy works only if people know it exists and understand why it matters. Introduce it with a short briefing and real examples. Make the approved tools easy to access, so following the policy is the easy option. Review it every six months, because tools and risks change quickly.
Policy checklist
- The policy fits on two or three pages and uses plain language.
- It names the approved tools and what each may be used for.
- It explains how to request a new tool and who approves it.
- It lists the specific types of data that must never be entered.
- It sets different data rules for business and public tools where needed.
- It states that users are responsible for checking output before use.
- It sets extra review for customer-facing, legal and financial content.
- It covers decisions about people and when AI may support them.
- It explains how significant uses are recorded and by whom.
- It says who to ask with questions and how to report a problem.
- It has an owner and a review date no more than six months away.
Draft your first version in a week, test it with a few managers from different teams and publish it with a short explanation. Improve it as questions come in.
Source: Intelliversal analysis.
