A practical company AI policy: what it should contain

01

Scope and responsibility

State who is covered, what the organisation treats as an AI system and who approves tools and use cases. Business, IT, security, privacy and process owners all need clear roles.

Separate experimentation on public data from production use affecting customers, employees, finance or safety. Controls should increase with impact and risk.

02

Approved tools and data

The approved list should identify the product version, account type and permitted purposes. Consumer and enterprise versions of the same service may have different terms.

• public and internal information;
• personal and special-category data;
• trade secrets and client information;
• code, configuration and security data;
• third-party copyrighted material.

03

Output control and transparency

Employees need to know when to verify a source, obtain approval and disclose AI use. Higher-impact work requires testing, documentation and meaningful human oversight.

Generated text must not automatically be treated as fact, legal advice or a final decision. The policy should define the review required for each class of use.

04

Keep the policy operational

Maintain a use-case register, a short assessment route, incident reporting and a review timetable. A material supplier or purpose change should trigger reassessment.

Measure behaviour rather than document acknowledgements: earlier reporting of new use, better knowledge of rules and less uncontrolled use.