Most AI policies are either missing or so long nobody reads them. A useful policy fits on a page or two, starts from how people already use AI, and makes the safe choice the easy one. This sequence gets a first version agreed in a week, then keeps it current. It is a practical starting point, not legal advice; have counsel review anything with regulatory or contractual weight.
Day 1 — Find out what is already happening
Goal: Base the policy on real use, not assumptions.
- Ask staff which AI tools they use, for what, and with what information.
- List the accounts: company-paid, personal and free tiers.
- Note any customer, contract or industry rules that mention data handling.
- Collect the questions people already ask about what is allowed.
You finish with: An honest picture of current AI use and the rules that already apply.
Day 2 — Classify the information
Goal: Decide what may and may not go into AI tools.
- Sort information into a few simple classes, such as public, internal, confidential and restricted.
- Give one plain example of each class from your own business.
- Decide which classes may be used with which approved tools.
- Name the information that never goes into any AI tool.
You finish with: A one-table data rule anyone can apply in seconds.
Day 3 — Approve the tools
Goal: Give people a safe default instead of a list of bans.
- Choose the approved tools and the account type for each, preferring business plans with admin controls.
- Check each tool’s data retention and training settings, and set them.
- Decide how someone requests a new tool, and who approves it.
- Plan how personal or free accounts are phased out for work use.
You finish with: An approved-tools list with settings and a request path.
Day 4 — Set review and accountability
Goal: Decide where a person checks the output before it matters.
- List outputs that need human review: anything sent to customers, published, legal, financial or about people.
- Make clear that the person who uses the output is responsible for it.
- Say how mistakes or data exposure are reported, and to whom.
- Name one owner for the policy and its updates.
You finish with: Review rules, a reporting path and a named policy owner.
Day 5 — Publish, teach and schedule the review
Goal: Make the policy known and keep it current.
- Write the policy in plain language, on one or two pages.
- Walk the team through it with examples from their own work.
- Put it where people look: the handbook, the intranet and the tool itself where possible.
- Set a date to review it, and review sooner when tools or rules change.
You finish with: A published policy, a trained team and a review date.
Common pitfalls
- Banning AI outright, which pushes use onto personal accounts.
- Copying a long template nobody reads.
- Rules with no approved tool to use instead.
- No owner, so the policy is out of date within months.