A one-page AI policy your team will actually follow

Most AI policies fail for the same reason most safety inductions fail: they're long enough that people read the opening line, infer the rest, and get the inference wrong.

The version that works is a page. Occasionally two. It answers four questions and it has one name on it.

The four questions

1. Which tool, and which account.

Named. Not "approved AI tools", not "tools sanctioned by management" — the actual product, and whether it's the free or paid tier, personal or business account. This is the most skipped line in every policy we read and the one that matters most, because the account type changes what happens to the text your team pastes in more than the brand does. The reasoning is in free tier, paid tier.

2. What never goes in.

In your own documents' terms. Not "personal information" but the names you actually use: client files, patient notes, participant plans, tenancy records, payroll. A list that names real documents gets followed; a list of abstract categories gets nodded at, and then someone decides for themselves at 6pm on a deadline.

3. What gets checked before it leaves the building, and by whom.

The single line that makes everything else defensible. Drafted by whoever has the facts, checked by whoever carries the responsibility. Write down which document types require a check by a specific role rather than "as appropriate". What the check itself covers is in how to check an AI draft in five minutes.

4. Who to ask when something isn't covered.

A name. Not a process, not an inbox, not "your manager". Something will always fall outside the rule, and whether people ask or guess depends entirely on whether asking is a single, obvious step.

The two versions that fail

The one-line ban. Staff must not use AI tools. It reads as decisive and it fails quietly: the work moves to personal phones, your visibility drops to zero, and the first you hear about it is when something has already gone out the door. You end up with the same exposure and no record of it.

The generic six-pager. Downloaded, lightly edited, and it doesn't name a single document your business produces. Staff can't tell whether their Tuesday afternoon task is covered, so they decide for themselves — which is precisely the situation the policy was written to fix.

Both are worse than nothing in one specific sense: they create the appearance of a control, which stops anyone asking whether there is one.

Write it after you know what's happening, not before

The order matters. A rule built on an assumption about what your team is doing is a rule you can't enforce, and the assumption is usually wrong in the same direction — more unreported use than the owner expects, on more personal accounts.

Establish first: which tools, which accounts, what kinds of documents, and whether any of it is recorded anywhere you could produce if someone asked. Ask about the work rather than the tool, or you'll get a clean sheet that means nothing — how to run that conversation is its own article.

Then write the page. Then train people to work inside it.

Two things to expect afterwards

Use goes up, not down. Reliably. Not because the rule encourages anything, but because the careful people — usually the most senior and most exposed — stop treating the whole category as risky once they can see where the line is.

The first hard case arrives within a fortnight. Something the page doesn't cover, brought to you by someone who read it properly. That's the policy working. Answer it, and if the answer is general, add a line.

Starting drafts are on the AI policy templates page — free, no email required. Mark one up with your objections; arriving at a policy session with a marked-up draft is considerably faster than arriving with a blank page. If the work is regulated, the sequencing in audit-readiness is the lever is the one to read first.