AI Usage Policy Template
Copy this. Edit the [BRACKETED] sections. Email to your team. Update quarterly. This is not legal advice — for regulated industries (legal, medical, financial), have counsel review.
1. Why we have this policy
AI tools (ChatGPT, Claude, Gemini, Copilot, etc.) can make our work faster and better. They can also leak data, produce confidently wrong output, and create legal exposure if used carelessly. This policy keeps the upside while managing the risks.
2. Sanctioned tools
These tools are approved for company use. If a tool isn't on this list, ask before using it for work data.
- [CLAUDE / CHATGPT / GEMINI / COPILOT] — for [TASK TYPES]
- [ZAPIER / N8N / MAKE] — for automations
- [GAMMA / NOTION AI] — for documents and decks
- [OTHER]
3. What you CAN paste into AI tools
- Public information (anything on our website, press releases, public-facing docs)
- Your own work product (drafts, notes, ideas)
- De-identified examples (names removed, numbers rounded, dates shifted)
- Internal SOPs, templates, and process docs (unless marked confidential)
4. What you CANNOT paste into consumer AI tools
- Customer or client PII (names + financial / health / legal details)
- Employee personnel records or compensation data
- Trade secrets, source code, or strategic plans
- Anything covered by NDA, BAA, or contract confidentiality
- Credentials, passwords, API keys, or access tokens
- For regulated industries: anything covered by HIPAA, PCI, GLBA, or attorney-client privilege
For sensitive data: use [APPROVED ENTERPRISE TIER — e.g., Claude Team, ChatGPT Enterprise] which has appropriate data agreements in place. Free / personal accounts are not acceptable for sensitive data.
5. Human review required
AI drafts; humans send. The following must be reviewed by a human before it goes out:
- Anything sent to clients or customers (email, document, contract)
- Anything publicly posted under our brand
- Anything that includes specific facts (dates, prices, names, citations) — verify each one
- Anything that constitutes a recommendation, opinion, or commitment
6. Disclosure
[CHOOSE ONE — depends on your industry and client expectations]
- We do not need to disclose use of AI for routine internal work.
- For client-facing deliverables: [DISCLOSE / NOT DISCLOSE / DISCLOSE IF ASKED]
- For regulated work: follow [APPLICABLE RULE / BAR GUIDANCE]
7. Audit trail
For [SPECIFIC WORK TYPES — e.g., legal memos, financial models, medical documentation], log: tool used, prompt used, date, who reviewed.
8. When unsure, ask
Designated AI lead: [NAME, EMAIL]. When in doubt, default to NOT using AI for that task and ask first.
9. Updates
AI tools change monthly. We review this policy quarterly. Last updated: __/__/____. Next review: __/__/____.