Write rules people can apply during a task

A useful policy answers the question an employee faces before pasting, uploading, sending, or acting. List approved tools and accounts, the information categories allowed in each, and examples of prohibited use. Link to existing privacy, security, records, employment, and client-confidentiality rules instead of pretending AI sits outside them.

  • Approved tools and account types
  • Permitted, restricted, and prohibited information
  • Tasks that require review or are not allowed
  • Required disclosure, recordkeeping, and approval steps
  • Incident contact and stop-work procedure

Assign ownership at the output

Name the person responsible for verifying an AI-assisted result before it reaches a customer, employee, regulator, system, or public channel. The vendor and model do not replace the organization’s responsibility for its actions.

Higher-risk areas need specific controls. Employment, legal, health, financial, safety, security, and rights-affecting work may require professional advice, testing, documentation, and legal review beyond a general policy.

Test the policy with real scenarios

Ask the team to apply the answer to five common tasks. If people cannot tell whether a customer email, meeting transcript, spreadsheet, or public document is allowed, the policy needs a clearer example. Record exceptions and revise the rule rather than relying on private workarounds.

Set a review date and update the policy when approved tools, contracts, laws, or work practices change. Keep the current version easy to find.

Practise on real work

Write an interim one-page policy

Use this to organize questions. Obtain appropriate professional review for your organization and jurisdiction.

Instructions to copy and change

Using only our approved notes, write a one-page interim AI use policy with: purpose, approved tools, permitted information, prohibited information, allowed tasks, tasks requiring human review, accountable role, incident reporting, and review date. Mark legal, privacy, security, employment, or contractual questions with [PROFESSIONAL REVIEW]. Do not invent requirements.

Important details to check

  • Can a team member apply each rule to a real task?
  • Is responsibility assigned to a named role?
  • Have required professional reviews been identified rather than guessed?

Keep these points

  • Write task-level rules with examples.
  • Assign responsibility for every external result.
  • Review the policy with qualified advisers where required.

Optional paid help with Ikram Rana

Get help with a recurring work task.

Bring a task you already understand and the tools your workplace permits. Discuss where AI could help and what you need to review before using the result.

Discuss your task with Ikram

Scope and fees are agreed before work starts. The guides stay free.

For another task to try each week, subscribe to the newsletter. A subscription is optional.

Official sources and further reading

Product features and policies change. Check the linked source before relying on tool-specific details.