Template · Keeping it safe
Team AI-use policy outline
Many teams use AI under rules nobody has written down. People guess, and they guess differently. This outline helps a manager write the team’s rules on one or two pages, in plain language.
It sits under your organization’s policy, not in place of it. Where the organization has a rule, the team policy points to it and says what it means for this team’s work. Ask your legal or security team to review the result before you share it.
When to use it
- Your team uses AI tools and has no written guidance of its own.
- People on the team have asked what they are allowed to paste into which tool.
- Your organization’s policy is general, and the team needs it applied to its own work.
The template
Scope
Who does the policy cover, and which work?
Approved tools
Which tools may the team use, and for which kinds of data?
Data rules
What may never be pasted, and what must be removed first?
Review before sending
What must a person check before AI-assisted work leaves the team?
Disclosure
When must the team say that AI was used?
Decisions AI does not make
Which decisions need a person, whatever the tool suggests?
Reporting a problem
What should someone do if data went where it should not?
Owner and review date
Who maintains the policy, and when is it next reviewed?
A filled example
The head of a customer success team writes a policy for twelve people who use AI to draft replies, summarize calls, and prepare account reviews.
- Scope
- All customer success staff and contractors, for any work involving customer accounts.
- Approved tools
- The company AI workspace: any data, including customer data. Other AI tools: public information only. Personal accounts: never for work.
- Data rules
- Never: passwords, payment details, health information. Remove before using any tool outside the workspace: customer names, emails, and account numbers.
- Review before sending
- Every customer-facing message is read in full by the sender. Figures and commitments are checked against the account record.
- Disclosure
- When a customer contract requires it, and whenever a customer asks. Use the standard sentence in the team folder.
- Decisions AI does not make
- Refunds and credits, account closures, and any judgment about a colleague’s performance.
- Reporting a problem
- Stop using the tool for that material, tell the team lead and the security team the same day, and do not try to fix it alone.
- Owner and review date
- Head of customer success. Reviewed every six months, or when the approved tool list changes.
What each field is for
Scope
Skill: Keeping it safe
A policy with a clear scope tells each person whether it applies to them. Contractors are easy to forget and often handle the same data.
Approved tools
Skill: Keeping it safe
The core safety rule is that sensitive data goes only into approved tools. Listing the tools turns that rule into a choice people can make in a second.
Data rules
Skill: Keeping it safe
Concrete examples of data classes are easier to follow than a general instruction to be careful.
Review before sending
Skill: Getting real work done
The person who sends the work owns it. A stated review rule makes that ownership part of the process.
Disclosure
Skill: Getting real work done
Disclosure rules often come from contracts. Writing them down, with a ready sentence, removes the temptation to avoid the question.
Decisions AI does not make
Skill: Keeping it safe
Some decisions affect people, money, or legal standing. Naming them in advance holds the line when a deadline makes a shortcut tempting.
Reporting a problem
Skill: Keeping it safe
Clear steps make people more likely to report quickly. A quick report contains the damage. A quiet fix often makes it worse.
Owner and review date
Skill: Keeping it safe
Tools and rules change. A named owner and a date keep the policy from describing tools the team no longer uses.
Common mistakes
Writing rules nobody can apply in the moment
“Use AI responsibly” gives nobody a decision. Name the tools, the data classes, and the steps, so a person can apply the rule in a few seconds.
Banning everything
A policy that forbids all AI use pushes it into personal accounts, where nobody can see it. Approve a safe route for the work people already do.
Treating a mistake as misconduct
If reporting a mistake leads to blame, people stop reporting. Handle honest mistakes in proportion, and fix the gap in tools or training that made them easy.