If your staff use AI assistants, and most do, your business already has an AI policy. It is just unwritten, and it probably amounts to “whatever each person thinks is fine”. A written acceptable use policy replaces guesswork with a few clear rules, protects client information, and gives staff the confidence to use AI well rather than secretly.
It does not need to be long. The best policies fit on two pages and are written in plain language.
What the policy should cover
1. Purpose and scope
Say why the policy exists: to let staff benefit from AI while protecting clients, the business and its information. State who it applies to, including employees, contractors and anyone using company data, and which tools it covers, including AI features built into software you already use.
2. Approved tools
List the AI tools staff may use for work, on company accounts, for example Microsoft 365 Copilot, or ChatGPT or Claude on a business plan. Make the rule explicit: work information goes only into approved tools on company accounts, never into personal or free accounts.
This is the heart of the policy. Business plans give you admin control, and their providers state that business data is not used to train their models by default. Personal accounts often have different terms and give you no visibility at all.
3. What information may be used
Staff need a simple test, not a legal essay. A three-level approach works well:
- Fine to use: public information, general questions, your own drafting
- Approved tools only: internal documents, business plans, non-sensitive client work
- Never, without specific approval: personal information about clients or staff, health information, financial account details, passwords, and anything under a confidentiality agreement
Alberta businesses handle personal information under privacy laws such as the Personal Information Protection Act (PIPA). Your policy should not let staff undermine the promises your privacy policy makes.
4. Checking the output
AI tools can be confidently wrong. They invent facts, figures, quotes and sources. The policy should say that:
- AI output is a draft. A person is responsible for anything sent, published or relied on.
- Facts, figures and references are checked against a reliable source before use.
- Advice to clients, whether legal, financial, medical or technical, is never passed on straight from an AI tool.
5. Transparency
Decide when staff should disclose AI use, for example when a client has asked, when a contract requires it, or when content is published under someone’s name. Many businesses also avoid AI-generated images or text that could be mistaken for real people or events.
6. Fairness in decisions about people
If AI is used anywhere near hiring, performance or customer eligibility, require human decisions and review for bias. AI can reflect and amplify unfair patterns in the data it learned from.
7. Requesting new tools
New AI tools appear every week. Give staff a simple way to request one, and a clear owner who reviews its terms, security and data handling before approval.
8. Training, breaches and review
Say how staff will be trained, what happens if the policy is broken (usually a conversation first, since the goal is safe use rather than punishment), and when the policy will be reviewed. Every six months is sensible while the tools are changing this quickly.
A one-page outline to adapt
- Purpose: use AI to work better while protecting clients and the business
- Scope: all staff and contractors, all AI tools and AI features in other software
- Approved tools: named tools on company accounts only
- Information rules: fine / approved tools only / never
- Output: AI output is a draft; people are accountable; facts are checked
- Transparency: when AI use is disclosed
- People decisions: human decision-making and bias review
- New tools: how to request, who approves
- Training and review: how staff learn, and when the policy is updated
This outline is a starting point, not legal advice. Businesses in regulated fields, such as legal, health or financial services, should also check the rules of their professional body.
Make the approved path the easy path
A policy that bans everything gets ignored. The most effective approach gives people a good sanctioned tool, so there is no reason to reach for a personal account.
A policy works best alongside the technical controls that back it up, such as limiting which apps can reach company data. Our managed security service covers that side.