AI use policy template: General edition

1. Purpose

This policy says what artificial intelligence (AI) tools may and may not be used for at [Company name]. It exists so that everyone on the team makes the same call, and so that a client, insurer or regulator who asks gets one clear answer.

2. Scope

• This policy applies to everyone who works for or with [Company name]: employees, contractors, interns and temporary staff.
• It covers every AI tool: chat assistants such as ChatGPT, Claude, Copilot and Gemini, AI features inside software we already use, and any tool with AI in it that a team member signs up for.
• It covers work done on company devices and on personal devices when the work is for [Company name].

3. What AI may touch

AI tools may be used, with the human review below, for:

• First drafts of internal documents, procedures, job descriptions and meeting notes.
• First drafts of marketing copy, web text and social posts that contain no customer details.
• Summaries of public information: articles, standards, published guidance.
• Code, formulas and spreadsheets that contain no customer or financial records.
• Brainstorming, outlines and plain-language rewrites of our own text.
• [Add or remove lines to fit your business]

4. What AI may never touch

Unless the tool is approved for exactly this use in writing, the following never goes into an AI tool:

• Customer or client personal details: names with contact details, account numbers, dates of birth, identification numbers.
• Anything covered by a non-disclosure agreement or a contract that forbids sharing it with a third party.
• Passwords, API keys, access tokens and security settings.
• Financial records, bank details, payroll and tax information.
• Employee records, performance reviews and health information.
• Decisions about a person (hiring, credit, pricing, discipline) made by the tool alone, with no person deciding.
• [Add the data your business is bound to protect]

5. Approval of new tools

• [Name or role of approver] approves every new AI tool before anyone uses it for company work. Trying a tool with company or customer data counts as using it.
• Before approval, we check: where the tool stores what we type; whether our inputs train the vendor's models; who at the vendor can see our data; how we delete it; what it costs per month and per seat.
• The list of approved tools, and what each one is approved for, lives at [Location of the approved tools list].

6. Human review

• A person checks every AI-written document before it goes to a client, customer, regulator or the public. The person who sends it is responsible for it, not the tool.
• AI output is a draft. We do not send an answer we have not read from start to finish.
• Facts, figures, names, dates and quotations in AI output are checked against the source before they go out.

7. Records

• When AI helped write something we sent out, we note which tool was used, what we gave it, and who checked the result. The record lives at [Location of the AI use log].
• Records are kept for [12] months, or longer if a contract or regulator requires it.

8. Vendor terms

• Before a tool is approved, [Name or role] reads its terms for four things: whether our inputs train the vendor's models; how long the vendor keeps our data; where that data is stored; and who owns the output.
• Where a vendor offers a setting that stops training on our inputs, it is switched on before the tool is used, and the setting is checked every [3] months.
• Terms are re-read every [12] months and whenever the vendor announces a change.

9. Training

• Every team member reads this policy when they join and again once a year, and confirms in writing that they have.
• [Name or role] runs a short session on safe AI use at least once a year: what the tools do with what we type, how to check an answer, and what never goes into a chat window.

10. The four questions we can answer

A client, insurer or regulator who asks about our AI use gets these answers, kept current by the policy owner:

• Which tools we use and what for: [List]
• What data those tools never see: [Summary of the section above]
• Who checks AI output before it goes out: [Name or role]
• Who is responsible for AI use here: [Name, role]

11. Review date

• This policy is reviewed on [Review date], and sooner after any incident, any new tool, or any change in the law or in a client's requirements.
• The review checks that the approved tools list is current, that the records are being kept, and that the training has happened.

12. Sign-off

• Owner of this policy: [Name, role]
• Approved by: [Name, role]
• Date approved: [Date]
• Version: [1.0]
• Next review: [Review date]