The AI Usage Policy That Fits on One Page
Most AI policies fail because nobody reads them. Here is what to permit, what to forbid, and how to keep the whole thing to a single page.
Most AI policies fail in the first week
The usual pattern: legal drafts fourteen pages, it goes out as a PDF attachment, people skim the subject line, and nothing changes. Meanwhile half the company keeps pasting client material into whatever chatbot is open in the next tab. The policy exists, so the risk looks managed. It isn't.
A policy only works if a new hire can read it in two minutes and recall it three months later at the moment they are about to paste something. That constraint — recallable under time pressure — is what should drive the drafting, not completeness.
Start with what people may do
Policies that only forbid produce shadow usage. Staff still have the same deadlines, the tools are free and one browser tab away, and now they have a reason not to mention it. You lose the visibility you were trying to gain.
So lead with permission. Name the specific tools your company has approved, by product name, with the account type — the paid business tier, not the free consumer one, because the data terms differ. Then say plainly that people may use them for drafting, summarising, research, first-pass analysis, code, translation, and thinking out loud. If a task fits in that list and the data rule below allows it, nobody needs to ask.
That single paragraph does more for governance than a chapter on responsible AI principles. It gives people a legitimate path, which means the illegitimate ones stop looking necessary.
Forbid a short list, and be concrete
Keep the prohibitions few enough to memorise. Five is a good ceiling. Each one should describe an action, not a value:
- Do not put customer personal data, credentials, unreleased financials, or anything under NDA into a tool that is not on the approved list.
- Do not send AI-generated work to a customer, regulator, or the board without a named person reading it first.
- Do not let a model make a final decision about a person — hiring, firing, credit, pricing, eligibility.
- Do not buy or connect a new AI tool on a personal card or a personal account.
- Do not present AI-generated material as someone's original work where authorship matters — legal filings, audited figures, published research.
Notice what is absent: no ban on "unethical use", no requirement to "use AI responsibly". Those read as filler and give nobody a decision rule. If a sentence would not change what someone does on a Tuesday afternoon, cut it.
Classify the data, not the task
The most common drafting mistake is trying to enumerate approved use cases. You will never finish, and the list ages badly.
Sort your information instead. Three tiers is enough: public, internal, and restricted. Public goes anywhere. Internal goes into approved tools. Restricted goes nowhere without a named exception. Then give two or three real examples of each drawn from your own business, because "confidential" means nothing until someone sees that the pricing sheet is internal and the client's medical records are restricted.
Data tiers survive the arrival of tools that don't exist yet. Use-case lists don't.
Put a name on the output
Every AI-assisted deliverable needs a human owner: the person who sends it owns it, exactly as they would own a draft from a junior colleague. That one sentence carries most of the accountability weight in the whole document. It also settles the disclosure question — you disclose when a reader would reasonably want to know, and the owner makes that call.
Give people somewhere to go when the policy doesn't cover their situation. Name a person and a channel, and commit to a turnaround. Two working days is realistic. Without that route, ambiguous cases resolve themselves silently in whichever direction is fastest.
How to hold it to one page
Cut anything already covered by your confidentiality agreement, your security policy, or the law. Cut the definitions section. Cut the philosophy. Give the page a version number, a date, and an owner, and expect to reissue it two or three times a year as tools and terms change — a policy that is easy to revise gets revised.
Then test it before you publish. Hand the draft to four people from different teams with three real scenarios and ask what the policy tells them to do. If two of them disagree, the page is not clear enough yet. That half-day of testing is worth more than another legal review.
The heavy part of AI adoption is rarely the technology. It is getting a few hundred people to make consistent decisions without a lawyer in the room. One page they remember does that. Fourteen they ignore does not.
If you want a second pair of eyes on yours, that is the kind of weight we carry for clients.