Short answer: a useful AI usage policy fits on two pages and answers four questions: which tools are approved, what data can go into them, who is accountable for the output, and how to ask for something new. Long policies that ban everything push people to use personal accounts instead.
The data classification table is the heart of it
| Data class | Examples | Approved company AI tools | Public / personal AI tools |
|---|---|---|---|
| Public | Published docs, marketing copy | Allowed | Allowed |
| Internal | Internal processes, non-sensitive code | Allowed | Not allowed |
| Confidential | Customer data, financials, contracts, source code of core products | Allowed only in tools approved for this class | Not allowed |
| Restricted | Credentials, health data, personal data covered by law | Not allowed unless a specific tool is approved | Never |
A two-page template
- Purpose: we want people to use AI to work better, safely.
- Approved tools: list, with the data class each one is approved for and how to get access.
- Data rules: the table above, plus “never paste credentials or secrets”.
- Accountability: you are responsible for anything you publish, send or merge, whoever drafted it.
- Disclosure: when AI-generated content must be labelled (for example customer-facing text, if required).
- Code: AI-generated code follows the same review, testing and license checks as any other code.
- Requests: how to propose a new tool or use case, and who decides.
- Review: the policy is revisited every quarter.
This is a starting point, not legal advice. Have legal and security review the policy, especially for personal data and regulated industries.
Make it easy to follow
- Provide at least one approved tool that is good enough, so people do not need personal accounts.
- Publish examples of allowed and not allowed prompts.
- Log usage of approved tools centrally, so you learn what people actually need.