Writing a company AI policy is the easy part. The hard part is the week after it is emailed out, when most staff skim the first paragraph, file it, and carry on using whatever tool they were using before.
A policy gets followed when it is short, when people hear about it more than once, and when following it is easier than ignoring it. Here is a four-step rollout that does that.
1. Write it for the person, not the file
The staff-facing part should fit on one page: which tools, what data never goes in, when a human checks, who to ask. Governance detail can live elsewhere. If you need a starting point, the free AI policy template is laid out that way, and our AI acceptable use policy examples show weak and strong wording for each clause.
2. Launch it with a message people will read
Not "please find attached the updated policy". Lead with what changes for them.
Subject: Using AI at work: what is allowed from Monday
From Monday you can use [Tool A] and [Tool B] with your work
account for drafting, summarising and analysis.
Three rules:
1. No customer personal data, passwords or confidential client
material in any AI tool.
2. A person reads anything AI-assisted before it goes to a
client or feeds a decision about someone.
3. Any other tool: ask IT first.
Full policy (one page): [link]
Questions: [channel], answered within a day.Send it from a senior leader, not a shared mailbox. Who sends it tells people how seriously to take it.
3. Train with examples, not slides
Thirty minutes per team is enough. Skip the history of AI. Walk through five real scenarios from that team's work and ask the room whether each is allowed:
- Pasting a customer complaint into ChatGPT to draft a reply.
- Using Copilot to summarise an internal meeting.
- Asking AI to rank job applicants.
- Uploading a client's draft contract for review.
- Using a free tool on your phone for a work email.
The disagreements in the room show you exactly where the policy is unclear. Fix the wording afterwards.
4. Make the right way the easy way
- A named place to ask. A channel or inbox with a promised response time.
- Approved tools that actually work. If the approved tool is worse than the free one, people will use the free one.
- Rules built into the tools. Instructions set at company level, so assistants already know what not to do, beat any amount of reminders.
- No blame for reporting. Mistakes reported fast are cheap. Mistakes hidden are not.
Review at six months
Look at three things: the questions people asked most (the policy is unclear there), tools requested (demand you are not meeting), and any incidents. Update, then send a short "what changed" note rather than re-sending the whole policy.
Questions people ask
Should staff sign the AI policy?
An acknowledgement helps with accountability, but it does not create understanding. Do it alongside the training, not instead of it.
How do we handle people already using unapproved tools?
Give a clear switch-over date and an amnesty for past use. You want people to move, not hide what they did.
Who should run the training?
Someone who uses the tools daily, alongside whoever owns the policy. Credibility matters more than seniority here.
Where to take this next
The House Rules turns your policy into one set of instructions every AI assistant in the company follows, so the rules apply inside ChatGPT, Claude, Gemini and Copilot, not just in a document.
Laisser un commentaire :