Generative AI went from ‘novelty’ to ‘everyday work tool’ remarkably quickly. One minute we were asking it to turn a policy into an iambic pentameter poem, the next, people were using it to summarise documents, draft customer emails and automate parts of their jobs.
One person is using Copilot to summarise a document. Someone else is asking Claude to help with an email. Another person has discovered an AI tool that promises to turn three hours of work into three minutes and is understandably rather excited about it.
The problem is that no one knew where AI tools where going, what the risks are or what the rules need to be. This is where an AI policy comes in.
What is an AI policy?
An AI policy gives your team clear boundaries for using AI safely and responsibly. It helps protect the business without leaving financial, data and compliance risks unchecked. Most importantly, it gives staff a clear and consistent way to use AI, so they can benefit from it without creating new risks or operational headaches.
So, what should your AI policy include?
1. Start with the AI tools people can use
Your policy should clearly identify your approved AI tools and what employees should do before trying something new.
This matters because different AI tools handle your data in different ways. Many free tools use the data you put in to train the AI model and therefore your data is not kept safe.
2. Set rules around your data
This is the biggie.
Define what employees can and cannot give an AI system - think customer details, financial information, passwords, commercially sensitive documents and personal data.
The golden rule should be: just because AI can process something doesn’t mean you should give it access to it.
Your existing data permissions matter too. An AI policy should work alongside your GDPR responsibilities, information security controls and access permissions, rather than working as a completely separate policy. At Resolve, our policy emphasises that employees remain accountable for the information they input, how it is processed and what they do with the output.
3. Make it useful, not just safe
A good AI policy should explain what good AI use looks like too. Encourage employees to use it when it genuinely saves time, improves quality or helps them do something they couldn’t easily do before.
AI for the sake of AI isn’t the goal.
4. Decide when people need to declare AI use
Do employees need to say when AI has helped create something? It might not be necessary every time someone asks Copilot to tidy up a sentence, but significant AI involvement in reports, policies, research or customer-facing work may need to be transparent.
Decide where that line is for your organisation and put it in the policy.
5. Keep humans in charge
AI confidently getting something completely wrong is not exactly unheard of.
Your policy should therefore establish a simple principle:
AI can assist, but a human remains responsible.
AI-generated work should be checked before it’s sent, published or used to make a decision. For important outputs, such as proposals, contracts, tender documents or significant customer communications, consider requiring an additional human review.
That’s particularly important if errors could have financial, contractual or reputational consequences.
6. Cover agents, automations and integrations
An AI policy isn’t just about people typing prompts into Copilot.
AI agents can connect to company information, use plugins or connectors and automate parts of a workflow. Your policy should establish who can approve these systems, what information they’re allowed to access and how their actions are monitored.
7. Give AI governance an owner
Someone needs to be responsible for keeping the policy up to date, approving new tools and making the call when something falls into a grey area. This might be the IT Manager, Operations Director, Finance Director or Managing Director depending on the structure of the organisation. Without an owner, “check first” quickly becomes “ask three people and hope somebody knows”.
8. Make it clear what to do when things go wrong
Someone accidentally shares information they shouldn’t have, an AI tool produces something inappropriate or an automation behaves unexpectedly.
Now what?
Your policy should include a clear route for reporting AI incidents, who owns the response and how issues are escalated.
Most importantly, encourage people to report mistakes quickly rather than hoping nobody notices.
9. Make your AI policy a living document
Don’t create a 46-page policy, upload it somewhere and consider the job done. It only works if people understand and follow it.
Keep it clear, review it regularly and update it as new AI tools and ways of working emerge. Train your team using real examples of what is and isn’t acceptable and make sure they know who to ask when they’re unsure.
10. Make sure AI written outputs still sounds like you
AI can write a perfectly good email, proposal or social post, but that doesn’t necessarily mean it sounds like your business.
Your policy should make it clear that employees are responsible for checking AI-generated content before it goes anywhere. We have already mentioned checking the facts, but it is also important to check the language, tone and whether it sounds like something your organisation would say.
For example, if someone uses Copilot to draft a client email, they shouldn’t simply copy, paste and send it. They should read it, shorten or personalise it where needed and make sure it sounds like them and the company.
In summary, your AI policy should answer five things: which tools can be used, what data can staff access, who is accountable, who approves new uses and what happens when something goes wrong?
At Resolve we have already been though creating an AI policy and have helped several of the companies we support write theirs. We can help you review how AI is being used across your business, identify the risks and put controls in place without stopping your team from using it productively. This is part of our AI Kickstarter package.
