AI use policy template for organisations

Why your organisation needs an AI use policy

Your employees are probably already using AI tools such as ChatGPT, Claude, Gemini or Copilot, with or without permission. Without clear rules, confidential information can end up in public tools, AI-written content can go out unchecked, and nobody is sure who is accountable when something goes wrong.

A short, plain-language policy fixes that. It tells staff what they can use AI for, what they must never put into it, and who checks the result. The template below is a starting point: replace the text in [square brackets] and adapt it to your organisation, your sector and your country's law.

1. Purpose and scope

This policy sets out how [Organisation name] staff may use artificial intelligence (AI) tools in their work, so that we gain the benefits of AI while protecting our customers, our people and our information.

It applies to all employees, contractors and temporary staff, and to any AI tool used for [Organisation name] work, on company or personal devices: chat assistants, writing and summarising tools, transcription and meeting tools, image tools and AI features built into other software.

2. Approved tools and accounts

• Only use the AI tools on the approved list maintained by [IT / the policy owner]: [list approved tools and versions].
• Use company accounts for work, not personal accounts, wherever a company account is provided.
• Ask [IT / the policy owner] before using a new AI tool or a new AI feature for work. We will check how it handles our data.

3. Information you must never put into an AI tool

Unless a tool is specifically approved for that type of information, never enter:

• Personal data about customers, patients, students or members of the public
• Staff records, salaries, performance or health information
• Passwords, access codes, account numbers or security details
• Confidential financial information, contracts, pricing or plans that are not public
• Client or partner documents shared with us in confidence
• Anything you would not be allowed to email outside the organisation

If you are unsure whether information is confidential, treat it as confidential and ask first.

4. What AI may and may not be used for

Good uses include drafting and improving emails, reports and presentations; summarising long public or approved documents; brainstorming; checking tone and grammar; and analysing data that has been approved for the tool.

Do not use AI to make final decisions about people (for example hiring, promotion, discipline or credit); to produce legal, medical or financial advice without qualified review; to create content that impersonates real people; or for anything unlawful or against our code of conduct.

5. Human review and accountability

AI drafts; people decide. The person who uses an AI tool is responsible for the result, exactly as if they had written it themselves.

• Check facts, figures, names and references: AI can produce answers that sound right but are wrong.
• Check for bias, tone and anything that could mislead or offend.
• Get the usual approvals before anything AI-assisted is sent to a customer, published or used in a decision.

6. Transparency, copyright and intellectual property

Tell your manager or the recipient when AI has played a significant part in a piece of work where that matters, such as client deliverables or published content. Do not present AI-generated work as independent research.

Do not use AI to copy or closely reproduce other people's copyrighted work. Content created for [Organisation name] with AI belongs to [Organisation name] in the same way as other work you produce.

7. Security and AI-enabled scams

Criminals now use AI to write convincing phishing emails, clone voices and fake videos of senior people. Never act on an unexpected request to pay, change bank details or share access because it seems to come from a manager or supplier. Always confirm through a known phone number or in person, and report suspicious messages to [IT / security contact] straight away.

8. Data protection

Use of AI must comply with data protection law in every country where we operate, for example the Nigeria Data Protection Act 2023 (NDPA), the Protection of Personal Information Act (POPIA), Kenya's Data Protection Act, 2019, Ghana's Data Protection Act, 2012 (Act 843). If personal data might be processed by an AI tool, speak to [the data protection officer / policy owner] first.

9. Training, incidents and review

• All staff will receive training on using AI safely and productively, and on AI-related cyber risks, before using approved tools for work.
• Report any mistake, such as confidential information entered into an unapproved tool, to [contact] immediately. Early reporting limits the damage and will be treated supportively.
• [Policy owner] owns this policy and will review it at least every [12] months, or sooner when tools or the law change.

Approved by [name, role] on [date]. Next review: [date].

Before you adopt it

This template is general guidance, not legal advice. Ask your legal or data protection adviser to review your final policy, especially if you work in a regulated sector such as banking, healthcare or telecoms.