Company AI Use Policy: The Sections It Should Include

An outline for a company AI use policy: 10 sections from scope, approved tools and data rules to incident reporting and review cycles, with sample wording.

On orientation day, a new hire asks, "Can I use ChatGPT for work here?" HR says yes. The head of IT says they are not sure. The team lead says yes, but do not put customer data in it. Three answers from three people show the company has no written AI use policy, which puts both employees and the company at unnecessary risk. A good policy does not have to be long, but it must clearly answer the questions people actually have.

What is an AI use policy?

An AI use policy is a document that tells employees how they may use AI at work, which tools to use, what data must never go in, who is accountable, and what to do when something goes wrong. It is one part of wider AI governance, which you can read about in AI Governance for SMEs.

For organisations that want a standard to refer to, ISO describes ISO/IEC 42001:2023 as a management system standard for AI that applies to organisations of any size that develop, provide or use AI. In Thailand, ETDA's guidelines are a good Thai-language reference.

Ten sections your policy should include

1. Purpose and scope

Who the policy applies to (employees, contractors, partners) and what kinds of AI it covers, from chatbots and AI features in office software to systems the company builds itself.

2. Approved tools

Which tools may be used, on what kind of account, and how to request approval for a new tool.

3. Data rules

Data classification: what may go in and what may not, especially personal and sensitive data under the PDPA. Read more in PDPA and AI.

4. Permitted and prohibited uses

Sample wording: "Employees may use AI to help draft, summarise and research, but must not use AI to make decisions on hiring, lending or anything affecting individuals' rights without human review."

5. Human review and accountability

The person using AI is always accountable for the work they send out. Work that reaches customers or has legal effect must be reviewed by a human.

6. Transparency

When customers must be told they are talking to AI or that content was made with AI. This aligns with international practice, such as the EU AI Act requiring chatbots to tell users they are interacting with a machine.

7. Intellectual property

NIST AI 600-1 lists intellectual property as one of the risks of generative AI. The policy should require content checks before publishing and forbid putting clients' confidential work into unapproved tools.

8. Security

Never enter passwords or API keys, beware of external links and files that may contain hidden instructions (prompt injection), and never connect AI to company systems without going through IT.

9. Incident reporting

A channel for reporting seriously wrong answers, data leaks or misuse, with a clear statement that good-faith reports will not be punished.

10. Training and review cycle

Who must be trained on what, and how often the policy is reviewed, because the tools change very quickly.

An example in practice

Imagine a 30-person accounting firm that drafts a two-page policy. It says only company AI accounts may be used, clients' tax IDs and unpublished financial statements must never go in, any work sent to a client needs a reviewer's sign-off, and there is a shared email address for reporting incidents. After launch, repeated questions from staff drop, because everyone can check the answer in the same document.

The best policy is one employees can read in ten minutes and immediately know what they can do today.

Watch out for

• Do not copy another company's policy wholesale. Businesses and risks differ.
• Policies that ban everything are rarely followed. Offer safe options rather than only prohibitions.
• Content on law, employment contracts and penalties should be reviewed by your legal team or a professional before it takes effect.

What to do next

1. Find out which AI tools employees already use.
2. Draft the policy around these ten sections, in no more than two to three pages.
3. Ask representatives from several departments to read and comment.
4. Launch it with short training and real usage examples.
5. Set the next review date and collect frequently asked questions to improve it.

A policy only works when the team is ready to use AI. Read more about leading that change in Change management: bringing your team along with AI, and if you are growing your team for AI work, post a job at Plants.work for employers.