Do you need an AI policy for your staff?

The realistic starting position is that people are already using these tools for work, on personal accounts, without mentioning it — because it makes their job easier and nobody said not to. A policy does not decide whether use happens. It decides whether the business can see it, ask about it, and set boundaries around the parts that matter.

That reframing matters because the instinct in a cautious business is to prohibit, and prohibition produces the worst available outcome. Use continues on personal accounts, which are the ones with the least favourable data terms, and it becomes unmentionable — so nobody asks whether something is appropriate, and nobody reports it when something goes wrong. A permissive policy with clear boundaries produces safer behaviour than a restrictive one that is quietly ignored.

One page is enough and length is actively counterproductive, because a policy nobody reads is a policy nobody follows. Three things need saying. What is never permitted: credentials, and material held on a client's, patient's or employee's behalf unless a specific agreement covers it. What is fine and encouraged: drafting, summarising, explaining, brainstorming, working on the business's own non-personal material. And who to ask when it is unclear, by name, with the expectation that asking is welcome rather than a confession.

Two operational specifics carry more weight than the principles. Which accounts people should use, because the difference between a consumer account and a business one is usually the difference between inputs being retained or used for model improvement and not — and telling staff to use the business account is a control that requires no judgement from them. And the rule that outputs are checked before they leave the business, because the person who sends something remains accountable for it whatever produced it.

The disclosure question should be settled explicitly rather than left to individual discretion, since inconsistency is what causes trouble. A reasonable position for most small businesses: no disclosure needed for internal drafting; disclosure where a customer is interacting with an automated system rather than a person; and no output presented as an individual's own professional judgement unless they have actually exercised it. That last clause covers the case that generates real problems.

Finally, put a review date on it. This area changes fast enough that a policy written today will be partly wrong within a year — new tools, changed terms, capabilities that did not exist. A stated review date converts an inevitably ageing document into one that is expected to be revisited, which is the difference between a policy that stays useful and one that quietly becomes something nobody can follow.