How to set an AI usage policy for your team without guesswork

TL;DR — If your team is already using AI tools, the fastest safe move is to publish a short written policy that answers four things: which tools are allowed, what data is forbidden, what human review is required, and who approves exceptions. The single most likely fix for confusion is to stop relying on verbal guidance and put the exact rules in a shared document plus a required acknowledgment form. Reading time: ~5 min

Goal

When you are done, your team will have a written AI usage policy in a shared document, a named owner for approvals, a list of allowed and blocked use cases, and a simple acknowledgment record showing each team member has read it.

Prerequisites

• A document tool your team already uses, such as Google Docs, Microsoft Word/SharePoint, Notion, or Confluence
• A place to collect acknowledgments, such as Google Forms, Microsoft Forms, your HR system, or your internal ticketing tool
• Permission to publish a team policy in your company workspace
• A list of the AI tools your team currently uses or wants to use, for example ChatGPT, Copilot, Claude, Gemini, or built-in AI features in SaaS apps
• Your company’s existing security or confidentiality policy, if one exists
• The name of the person who will approve exceptions, usually the team lead, operations manager, or security contact
• 30 minutes with one decision-maker who can confirm what data is confidential and what customer commitments you must honor

Steps

Step 1: Create the policy document

Open your document tool and create a new page named exactly:

AI Usage Policy — [Team Name]

Paste this template into the document and replace the bracketed text:

## Purpose
This policy explains how [Team Name] may use AI tools for work.

## Approved tools
Staff may use only these AI tools for work:
- [Tool 1]
- [Tool 2]
- [Tool 3]

Any other AI tool requires approval from [Approver Name/Role] before use.

## Prohibited data
Do not paste, upload, or connect any of the following into any AI tool unless written approval is given:
- Customer data
- Personal data (information that identifies a person)
- Passwords, API keys, tokens, or secrets
- Source code from private repositories
- Contracts, financial records, or legal documents not already approved for sharing
- Internal-only strategy, incident details, or security documentation

## Allowed uses
These uses are allowed:
- Drafting outlines, summaries, and internal brainstorming
- Rewriting public-facing text that contains no confidential information
- Creating sample code that does not include private business logic or secrets
- Summarizing meetings from notes that contain no restricted data

## Human review requirement
A human must review all AI-generated output before it is sent to a customer, published, merged into production systems, or used for business decisions.

## High-risk uses that require approval
Approval from [Approver Name/Role] is required before using AI for:
- Customer-facing advice
- Legal, HR, finance, or security decisions
- Automated actions in production systems
- Processing uploaded files from customers
- Connecting AI tools to email, CRM, ticketing, code repositories, or document storage

## Output rules
Users must:
- Check facts, links, numbers, and citations before use
- Remove invented content and unsupported claims
- Label AI-assisted drafts internally when handing them to another team member

## Recordkeeping
Requests for new AI tools or exceptions must be sent to [email address or form link].

## Violations
If restricted data is entered into an AI tool or an unsafe output is used, report it immediately to [security contact or manager] using [channel].

What you should see when this step succeeds: a saved document with your team name, approver, and contact details filled in.

Step 2: Fill in the approved tools and blocked data with literal values

Edit the template so it contains the exact tools and exact blocked data types your team will use. Use a simple table like this in the document:

| Item | Value |
|---|---|
| Approved tools | ChatGPT Team, Microsoft Copilot for Microsoft 365 |
| Approver | Jordan Lee, Operations Manager |
| Exception request channel | ai-requests@company.com |
| Incident reporting channel | security@company.com or #security-help |
| Blocked data | customer lists, invoices, contracts, passwords, API keys, private source code |

What you should see when this step succeeds: the policy no longer contains placeholders like "[Tool 1]" or "[Approver Name/Role]".

Step 3: Add a simple decision flow your team can follow

Paste this flow into the document under a heading named "How to decide before using AI":

[Start]
   |
   v
[Is the tool on the approved list?]
   | yes
   v
[Does the prompt include restricted data?]
   | no
   v
[Use AI draft]
   |
   v
[Human review before sharing or publishing]

[Is the tool on the approved list?] ---- no ----> [Request approval]
[Does the prompt include restricted data?] ---- yes ----> [Do not use AI]

What you should see when this step succeeds: a short visual flow that answers the two most common questions without extra explanation.

Step 4: Publish the policy in your shared workspace

In your document system, move or save the page in your team’s shared location. Use your provider’s dashboard or workspace menu, for example:

Google Docs: Share → General access → Anyone in [your company] with the link → Viewer
Microsoft 365/SharePoint: Document → Share → People in [your company] with the link → Can view
Notion: Share → Publish internally or invite workspace members → Can view
Confluence: Space → Create page → Restrictions → View for your team

Name the final page exactly:

AI Usage Policy — [Team Name] — Effective [YYYY-MM-DD]

What you should see when this step succeeds: team members can open the policy link without requesting access individually.

Step 5: Create the acknowledgment form

Create a form with these exact fields:

Form title: AI Usage Policy Acknowledgment — [Team Name]

Field 1: Full name
Field 2: Work email
Field 3: Department or team
Field 4: Policy version read
Field 5: Checkbox — I have read and will follow the AI Usage Policy
Field 6: Checkbox — I will not enter restricted data into unapproved AI tools
Field 7: Checkbox — I understand that AI output requires human review before external use

If your form tool supports a confirmation message, set it to:

Thank you. Your acknowledgment has been recorded.

What you should see when this step succeeds: a shareable form link and a response list or spreadsheet where submissions appear.

Step 6: Send the rollout message with the exact action required

Send this message in email or chat to your team:

Subject: Action required today: read and acknowledge our AI Usage Policy

Please read this policy: [paste policy link]
Then submit this acknowledgment form: [paste form link]
Deadline: [YYYY-MM-DD]

Key rules:
1. Use only approved AI tools for work.
2. Do not paste customer data, personal data, passwords, API keys, private code, contracts, or internal security details into AI tools.
3. Human review is required before any AI output is sent externally, published, or used in production.
4. Request exceptions at: [email/form link]
5. Report mistakes immediately to: [security contact/channel]

What you should see when this step succeeds: the team has both links and a deadline in one message they can act on immediately.

Step 7: Track acknowledgments and close gaps

After the deadline, compare your team roster against the form responses. In your spreadsheet or form response view, create these columns if they do not already exist:

Name | Email | Acknowledged | Date | Follow-up sent

For anyone missing, send this exact follow-up:

Reminder: please complete the AI Usage Policy acknowledgment today.
Policy: [link]
Form: [link]

What you should see when this step succeeds: every active team member shows "Acknowledged" with a date.

Verify it works

Use these checks to confirm the policy is live end to end:

1. Open the policy link in a normal employee account. Expected result: the document opens without an access request.
2. Confirm the document includes these literal sections: "Approved tools", "Prohibited data", "Human review requirement", and "Violations".
3. Submit the acknowledgment form once as a test. Expected result: you see the confirmation message and a new response appears in the response list.
4. Ask one team member this question: "Can I paste customer data into an AI tool for summarization?" Expected result: they answer "No, not unless written approval is given in the policy."
5. Check your response list after the deadline. Expected result: every team member has a recorded acknowledgment date.

Common pitfalls

The policy says "confidential data" but never lists examples

Mistake: using broad words without naming actual data types. Symptom: staff think meeting notes, contracts, or source code are probably fine to paste into AI tools. Fix: replace generic wording with a literal list such as "customer data, personal data, passwords, API keys, private source code, contracts, financial records".

Too many tools are implicitly allowed

Mistake: saying "approved AI tools" but not naming them. Symptom: people use random browser extensions, free AI sites, or AI features inside other apps without review. Fix: add an exact approved-tools list and the sentence "Any other AI tool requires approval from [Role] before use."

No owner is named for exceptions

Mistake: the policy says approval is required but does not say from whom. Symptom: requests stall, and staff use tools anyway because nobody knows who decides. Fix: add one named role and one contact method, for example "Jordan Lee, Operations Manager" and "ai-requests@company.com".

Human review is implied but not required

Mistake: assuming staff know AI output can be wrong. Symptom: AI-generated text, code, or advice is sent externally without checking facts. Fix: add the exact sentence "A human must review all AI-generated output before it is sent to a customer, published, merged into production systems, or used for business decisions."

The policy is published, but nobody acknowledges it

Mistake: posting the document link and treating that as rollout. Symptom: weeks later, team members say they never saw it or did not know it applied to them. Fix: send one message with the policy link, form link, and deadline, then track responses in a simple roster.

The policy is never updated when tools change

Mistake: creating version 1 and forgetting it. Symptom: the approved list becomes inaccurate after new tools or integrations are introduced. Fix: put an effective date in the title and review the document on a recurring calendar reminder every quarter.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.