A short, clear AI policy that people actually read beats a long one nobody follows. One page: what's encouraged, what's allowed, what's never allowed, and who to ask.
Why one page
Long policies get filed and forgotten. Staff using AI need quick answers: Can I use it for this? Which tool? What can't I paste in? Who do I ask? A one-page policy answers those questions.
| Long policy | One-page policy |
|---|---|
| Written for lawyers | Written for staff |
| Read once, if at all | Pinned, referred to, remembered |
| Tries to cover every case | Covers the main cases; says who to ask for the rest |
| Out of date quickly | Easy to update every six months |
What the policy covers
Most one-page AI policies cover the same ten points. Adapt the wording to your business.
| Section | Covers |
|---|---|
| Purpose | Why we use AI and what we expect |
| Approved tools | Which tools and accounts may be used |
| Allowed uses | Encouraged everyday uses |
| Careful uses | Uses that need extra checking or approval |
| Never | Prohibited uses |
| Data rules | What never goes into AI tools (Chapter 3) |
| Checking and ownership | You check it; you own it |
| Openness | When to tell people AI was used |
| Incidents | What to do if something goes wrong |
| Owner and review | Who to ask; when it's updated |
Allowed, careful, never
The heart of the policy is three lists. Most uses are allowed; some need care; a few are never acceptable.
| Allowed (encouraged) | Careful (check or approve) | Never |
|---|---|---|
| Drafting emails and documents for you to edit | Content for customers or the public | Confidential data in unapproved tools |
| Summarising non-confidential documents | Anything legal, tax, medical or financial | Decisions on hiring, pay or firing by AI |
| Brainstorming and planning | Realistic AI images or voices (label them) | Fake reviews, fake people, impersonation |
| Learning and explaining concepts | Automations that act without a person | Payments or bank changes by AI |
| Translating, with a native check | Customer-facing bots | Using someone's face or voice without consent |
Write it with AI, decide it yourselves
AI can draft a one-page policy quickly from your decisions. The decisions themselves (what's allowed, which tools, what's never acceptable) are for leadership, with input from IT, HR and, where needed, legal advisers.
Launch it so people follow it
A policy works when people know it, understand why, and find it easy to follow. The launch matters as much as the text.
- Explain why, in person. A 20-minute session per department: the benefits, the risks, the three lists.
- Give them the tools. Approved accounts ready on day one, so the safe way is the easy way.
- Make it findable. Pinned in the staff group, printed near desks, on the intranet.
- Name who to ask. An AI champion in each department (Chapter 7).
- Review after three months. What's unclear? What's missing? Update it.
Questions from the worksheet: The one-page AI policy
Draft your policy decisions here, then ask AI to turn them into one page.
- Purpose: why we use AI
- Approved tools and accounts
- Allowed (encouraged) uses
- Careful uses (check or approve)
- Never
- Data rules (link to Chapter 3)
- Checking, ownership and openness
- Incidents: who to tell, no blame
- Owner and review date
What to remember
- One page people read beats a long policy nobody follows; encourage as well as restrict.
- Core: approved tools, allowed / careful / never, data rules, checking, openness, incidents, owner.
- Draft with AI from leadership's decisions; launch in person, with tools ready and an amnesty.
- AI policy
- A short statement of how an organisation uses AI and its rules.
- Approved tool
- An AI tool and account the organisation has vetted and provides.
- Amnesty
- An assurance that past use won't be punished, so people speak up.
This article is adapted from the book. Examples marked “Example” use invented names and numbers; company stories are based on public sources listed in the book. For general learning; use your own judgement for your situation.
