Before filling it in: choose a specific task
Which AI tools does your team already use, and for which tasks? Start with a recurring workflow, such as drafting a newsletter. Record which information is processed and who uses the output. The template below defines permitted use for each task and tool. Add separate rules for other combinations.
Template: seven policy clauses to copy and fill in
Copy the seven points below into your internal document. Replace every entry in square brackets and adapt the proposed rules to your decisions. Describe the task precisely: “Draft a newsletter from approved product information” is clearer than “Edit text”.
- Scope: This rule applies to [staff/external contributors] in [workflow]. AI may be used for [specific permitted task].
- Tools: For this task, we use only [service] with [business account/account type] and [permitted features]. [Name/role, contact] is responsible for access and settings. Other services, features or connections to document stores require approval from [name/role] before use.
- Data: We may enter [specific permitted material]. We must not enter [specific excluded material, e.g. customer names, personnel files, confidential prices]. If the category is unclear, we do not enter the material until [name/role, contact] has made a decision.
- Output: Before further use, [name/role] checks facts, figures, names, dates and commitments against [authoritative information source]. Unsupported statements are resolved or removed. An AI draft is not yet an approved company statement.
- Actions: [Name/role] may edit drafts; [name/role] approves the final content for [recipient/channel]. Under this rule, the AI tool must not send or publish content itself or make changes in other systems.
- Incidents: If incorrect material is entered or information is disclosed without permission, we stop the affected activity and immediately inform [contact, reporting channel]. We record the time, tool, types of data involved and action taken. [Name/role] decides on further steps.
- Maintenance: [Name/role] owns this rule. It was approved on [date] by [name/role] and is available at [document location]. Changes to the task, tool, data access or automated actions require a review before the changed use begins.
What if a case is not covered yet?
An unfilled placeholder is not permission. Keep a short list of unresolved tasks and data questions for the named owner. Until a decision is made, continue using the previously approved workflow. Record new approvals in the document so the same question does not need to be decided separately for every colleague.
Try the policy with three team scenarios
Discuss the draft with management, the person responsible for IT and colleagues who use AI. Use public or invented material for the exercise. Work through three situations: rewording a public text, summarising an internal note and responding to an enquiry containing personal data.
For each situation, the team identifies the permitted tool, allowed input and person who approves the output. If the answer is “not allowed” or “not yet decided”, discuss the case without entering it into an AI tool. If people interpret the same rule differently, improve the wording and repeat that scenario.
What the template provides and what still needs assessment
The template helps you record business decisions clearly. Whether the intended use is permitted needs a separate assessment of the data, contracts, settings and applicable legal requirements. A completed policy alone does not establish legal compliance.