AI Use Policy: A Practical Template Your Team Will Actually Follow

In nearly every company I coach, the honest answer is yes—whether or not leadership has said a word about AI. Someone on the team is pasting meeting notes into ChatGPT to get clean summaries. Someone else is drafting customer emails with it. A manager is using it to pressure-test a plan before it reaches your desk. People sometimes call this “shadow AI”: employees using consumer AI tools on personal accounts, outside any company rule, usually with perfectly good intentions. The tools are genuinely useful, which is exactly why employees reach for them without asking. None of this should alarm you. Shadow use is evidence that your team sees real value in these tools. The risk is not that your employees are using AI. The risk is that nobody has told them where the lines are.

A ban can look simpler than a policy, and some owners try one first. What I have watched happen: the work does not stop, it moves to personal phones and personal accounts, where the company has no visibility and no say. Employees who would have mentioned their AI use stop mentioning it—same usage, none of the control. A clear policy with two or three firm rules, plus a team that understands why the rules exist, beats a prohibition nobody can enforce.

Every workable AI use policy covers the same five things, and a small company can cover them in a page. First, an approved-tools list: name the specific AI tools employees may use, under company accounts, so “use good judgment” is never the whole rule. Second, a short list of information that may never go into any AI tool, written concretely enough that a new hire can apply it without asking. Third, a rule for client and confidential work, because client trust is where mistakes become expensive. Fourth, a disclosure rule: when and to whom employees say that AI contributed to the work. Fifth, an owner and a review date, because the tools change faster than any document. The template in the next section covers all five.

The ten clauses are a skeleton; the value is in making each one concrete for your business. Take clause four, the client-confidentiality rule. A marketing agency I worked with rewrote that clause to name its actual failure mode: account managers were pasting client campaign data into personal ChatGPT accounts to write reports faster. The agency's final version named the approved business-tier account, banned personal accounts for any client material, and gave a two-sentence example of an anonymized prompt that was fine. That specificity is what makes an AI policy usable. “Be careful with client data” protects nobody. “Client names and campaign numbers only go into the company's approved account, never a personal one” protects everyone.

Clause three, the never-paste list, deserves the same treatment. A distribution company might add photographs from the warehouse floor, because those photos show customer labels and shipment volumes. A professional services firm might add draft engagement letters, because the pricing in those letters is confidential. A business anywhere near healthcare might decide the simpler answer is right: no AI tools for anything touching patients, full stop. Sit with your leadership team for twenty minutes and ask one question: what would hurt most if it appeared in someone else's AI chat? The answers become your clause three.

Clause six, disclosure, is where owners most often overreach. Requiring employees to log every AI interaction creates a tracking burden nobody sustains, and it quietly punishes honesty. Reserve formal disclosure for work that leaves the building: client deliverables, published content, anything with your company's name on it. Inside the building, the norm you want is simpler—AI use is unremarkable, discussed openly, and never hidden. That norm is worth more than any tracking spreadsheet.

A written policy is the foundation, and for some companies it is enough for a while. The ceiling I see owners hit arrives once the policy starts working: employees are using approved tools openly, the red lines are holding, and the next question is capability. Who teaches the team to brief an AI tool well, to check its work quickly, to build the repeatable workflows—a weekly report, a client-update draft, a meeting-notes habit—that make the tools worth the guardrails? A policy without training gives you safe, shallow use. Most of the value sits on the other side of skill.

That combination—guardrails plus training—is exactly what I do with owners and their teams. In coaching, we write the policy together so the rules fit how your company actually works; then I train your team to work confidently inside those rules, on real tasks from their real week. The policy keeps your information where it belongs; the training turns the tools into hours back. For a starting picture of what day-to-day use looks like once the guardrails are in place, my guide to using Claude walks through the workflows I teach first.