If your team uses AI at all, and most do whether or not it is official, you need a policy. Not a forty-page document nobody reads, but one or two pages that say clearly which tools are allowed, what must never go into them and who checks the output. Here is what to include.
Why a short policy beats a long one
The point of an AI policy is to change everyday behaviour. People follow rules they can remember. A one or two page policy, explained in a short session and backed by good tools, does more than a long document filed away.
What to include
- Purpose: why the business uses AI and what it should help with.
- Approved tools: which AI tools and plans are allowed for work, and that personal accounts are not.
- Data rules: what may be used, what needs care, and what must never be entered.
- Human review: a person checks anything before it is sent, published or acted on.
- Accuracy: AI can be wrong, so facts, figures and references must be checked.
- Transparency: when to tell clients or customers that AI helped produce something.
- Access: who manages the tools, and how access changes when people join, move or leave.
- Training: everyone completes basic training before using AI for work.
- Questions and incidents: who to ask, and what to do if something goes wrong.
- Review date: when the policy will be updated.
Getting the data rules right
The data section does most of the work. A simple three-tier approach is easy to remember:
- Fine to use: public information, your own drafts, general business questions.
- Use with care, in approved tools only: internal reports and business documents, with client names and personal details removed.
- Never: passwords and credentials, payment card details, health information and other special category personal data, and anything a contract says must not be shared.3
Adjust the tiers to your sector and your contracts. The aim is that anyone can decide in a few seconds whether something belongs in an AI tool.
Rolling the policy out
- Set up an approved business plan first, so the policy points to a real alternative.
- Walk the team through the policy in a short session with real examples.
- Ask everyone to confirm they have read it.
- Build the rules into the setup: access controls, approved connectors, Project instructions.
- Review it after three months, then at least once a year.4
A policy works best alongside good tools. If the approved option is easy and genuinely helpful, people stop reaching for free tools nobody approved.
Sources
Links checked
- 1Information Commissioner's Office. Guidance on AI and data protectionico.org.uk ↗
- 2Information Commissioner's Office. Data protection impact assessmentsico.org.uk ↗
- 3Information Commissioner's Office. Special category dataico.org.uk ↗
- 4Anthropic Privacy Center. Is my data used for model training?privacy.claude.com ↗
Want help with this?
Claude training, done properly.
Practical, role-based Claude training built around your team's real work: hands-on workshops, playbooks and safe-use guidance, delivered remotely.
Claude is a trademark of Anthropic, PBC. Plans and features change over time, so check Anthropic's current documentation for the latest details. This guide is general information, not legal advice.