FORGE
Book a Demo

AI policy for employees

An AI acceptable use policy for employees, with a sample you can copy

An AI acceptable use policy tells employees which AI tools they may use for work, what information may go into them, how to check what comes out, and what to do when something goes wrong. A short policy people can follow beats a long one they cannot.

Below is a sample you can copy and adapt. After it is the harder part: making the policy hold when nobody is checking.

What a good policy covers

Most AI policies fail by being vague about information. Be specific about these:

  • Which tools are approved, and that personal accounts are not.
  • Which kinds of information may go into which tools, in classes people can recognise.
  • That the person who uses the output is responsible for it.
  • That AI does not make decisions about people on its own.
  • That software acting on the company's behalf needs an owner, limits and a record.
  • How to report a mistake, and that reporting quickly is not punished.

The sample policy

Replace the words in square brackets. This is a starting point, not legal advice: have it reviewed for the laws that apply to you, such as data protection law and any rules for your sector.

[Company] policy on the use of AI tools

  1. 1. Purpose and scope

    1. 1.1This policy sets out how people working for [Company] may use AI tools in their work, so that we gain from them without putting our clients', our employees' or our own information at risk.
    2. 1.2It applies to employees, contractors and anyone else doing work for [Company], on any device.
    3. 1.3An AI tool is any software that generates text, code, images, analysis or decisions, including AI features inside other software.

  2. 2. Approved tools

    1. 2.1Only the tools on the approved list, kept by [owner], may be used for [Company] work.
    2. 2.2Personal accounts of any AI tool, paid or free, must not be used for [Company] work.
    3. 2.3To propose a new tool, ask [owner]. Do not start using it while the request is open.

  3. 3. What information may be used

    1. 3.1Public information, such as published material, may be used in any approved tool.
    2. 3.2Internal information, such as internal notes and drafts, may be used in approved tools only.
    3. 3.3Confidential information, such as client material, contracts, financial information and unpublished plans, may be used only in [approved workspace], inside the project it belongs to, with the privacy protections switched on.
    4. 3.4Restricted information must not be entered into any AI tool unless [owner] has approved that specific use in writing. This includes customers' and employees' personal data, health information, payment card details, passwords and access keys.
    5. 3.5Do not upload material that belongs to someone else, such as a document received under a confidentiality agreement, unless the agreement allows it.

  4. 4. Checking what comes out

    1. 4.1You are responsible for anything you send, publish or act on, whether or not an AI tool helped produce it.
    2. 4.2Check facts, figures, quotations and references against their source before relying on them.
    3. 4.3Tell a client when AI was used in work delivered to them, where their contract or our engagement terms require it.

  5. 5. Decisions about people

    1. 5.1AI must not be the only basis for a decision about a person, such as hiring, pay, performance, credit or access to a service. A person makes the decision and can explain it.

  6. 6. Software that acts on our behalf

    1. 6.1An AI agent or automation that sends messages, makes payments, changes records or deletes anything needs a named owner, approved by [owner].
    2. 6.2It must work within written limits, send exceptions to a person, and keep a record of what it did.

  7. 7. Mistakes and incidents

    1. 7.1If confidential or restricted information goes into a tool it should not have, report it to [contact] within 24 hours.
    2. 7.2Reporting promptly is expected and is not a disciplinary matter in itself. Hiding a mistake is.

  8. 8. Records and review

    1. 8.1[Company] keeps records of how approved AI tools are used, such as who used which tool and when. These records do not include the content of your work unless an investigation requires it.
    2. 8.2[Owner] reviews this policy every six months, and when the law or our approved tools change.

Writing it is the easy part

A policy that depends on each person remembering it under deadline fails quietly. The confidential contract goes into a personal account because it was quicker, and nobody knows.

The rules that hold are the ones the tools enforce. An approved workspace where personal details are masked before they reach a model, where masking cannot be switched off by the person in a hurry, where access follows projects, and where every use is recorded, turns section 3 of the policy from a request into a fact.

Forge, by GradTensor, is built to be that workspace. An administrator sets the privacy rules once, members cannot weaken them, and the organisation can see usage and cost per person without reading anyone's documents.

Rolling it out in a fifty-person firm

  1. 1The operations lead adapts the sample, names an owner, and chooses one approved workspace for confidential work.
  2. 2Before announcing anything, the firm sets up the workspace: one project per client, masking on as an organisation rule, and the firm's own model key.
  3. 3The policy goes out with the workspace already in place, so the rule "use only approved tools" comes with a tool that is as quick as the one people used before.
  4. 4Each month the owner looks at usage per person and per project. Teams with no usage are asked what they use instead.
  5. 5After six months the firm reviews the policy against what it has learned, including any incidents reported under section 7.

What a policy cannot do

  • It cannot reach a personal phone. Without an approved tool that is as good, a policy moves AI use out of sight rather than stopping it.
  • It is not legal advice. Data protection, employment and sector rules differ by country, so have yours reviewed.
  • It goes stale. AI tools change their terms and features often, so the approved list and the information classes need a regular review.

Questions

What should an AI acceptable use policy include?

Which tools are approved, which information may go into them, who is responsible for the output, limits on decisions about people, rules for software that acts on the company's behalf, and how to report a mistake.

Should employees be allowed to use personal ChatGPT accounts for work?

Most policies say no. On a personal account the settings, including whether conversations may be used for training, belong to the employee, and the company has no record of what was shared.

Is it safe to upload confidential documents to ChatGPT? →
Do we need an AI policy if we have banned AI tools?

Yes. A ban without a policy and an approved tool tends to push AI use onto personal devices, where it is invisible. That is shadow AI.

What is shadow AI? →
Who should own the AI policy?

One named person, usually in operations, IT or risk, with legal review. The owner keeps the approved list, approves exceptions and runs the review.

How often should an AI policy be reviewed?

Every six months is a sensible default, and whenever an approved tool changes its terms or the law changes.

Read next

Book a Democontact@gradtensor.com