Creating a Common Sense AI Policy for Your Employees

If you run a business with 20, 50, or 150 employees, you already have an AI policy. For most companies, that policy is simply: "We hope nobody does anything stupid."

Hope is not a strategy. Right now, members of your team are almost certainly using generative AI tools to draft emails, summarize meeting notes, rewrite client proposals, and troubleshoot software errors. They are doing this not out of malice, but because they want to get their work done faster.

The problem is that without clear guardrails, employees make dangerous assumptions. They assume that free web tools treat their data with the same privacy standards as enterprise software. They assume that AI outputs are always accurate. And they assume that if management has not explicitly forbidden something, it must be acceptable.

At the same time, heavy-handed restrictions rarely work. Outright bans simply drive usage underground, creating a shadow IT environment where you have zero visibility into what business data is leaving your perimeter.

The goal of an AI policy is not to prevent employees from using modern tools. The goal is to provide a sensible, practical framework that protects your clients, your intellectual property, and your reputation while allowing your business to become more efficient. Here is how to build one.

The Cost of the "Ban or Ignore" Approach

Most small and medium-sized businesses fall into one of two traps when addressing artificial intelligence.

The first trap is the blanket ban. A leadership team reads a headline about a corporate data leak, panics, and issues an edict blocking AI websites on company networks. This fails almost immediately. Employees simply switch to their personal smartphones, copy paste text into personal accounts, and email the results back to their work addresses. You lose all visibility, and the security risk actually increases because the data now sits on personal devices outside your control.

The second trap is passive neglect. Management knows staff are experimenting, but treats AI as an individual productivity preference - no different than choosing between two different note-taking apps. This approach exposes the business to regulatory breaches, copyright entanglements, and client confidentiality violations.

A functional policy charts a middle path. It acknowledges that AI is a legitimate workplace tool, specifies which tools are safe, and establishes unambiguous boundaries around sensitive information.

Understanding the Difference Between Public and Protected AI

The single most important concept to communicate to your staff is the difference between consumer-grade AI tools and commercial-grade enterprise AI.

When an employee opens a free consumer tool in their web browser and pastes text into it, they are usually agreeing to terms of service that allow the provider to use that data to train future models. If a project manager pastes an unreleased client brief, a financial summary, or a customer dispute into a free engine, that data may become part of the vendor's training corpus.

By contrast, enterprise solutions - such as Microsoft Copilot with commercial data protection, or Microsoft 365 Copilot - operate under strict data boundaries. Under these agreements: - Your business prompts and responses are not used to train the underlying models. - Your data does not leave your designated commercial boundary. - User queries are bound by your existing Microsoft 365 permissions and access controls.

Your policy must make this technical distinction easy for a non-technical employee to understand. Staff do not need an engineering degree, but they must understand that pasting proprietary data into an unvetted, free web tool is a breach of basic operational security.

The Four Non-Negotiable Rules

A successful internal policy does not need to be twenty pages of dense legal jargon. In fact, if it is twenty pages long, nobody will read it. A great policy fits on two pages and centres on four straightforward rules.

### 1. The Human Owns the Output The employee who uses AI remains 100 percent responsible for the final work product. AI is a drafting assistant, not an author. If an employee uses an AI tool to generate code, draft a contract summary, or write an email to a client, that employee is personally accountable for every error, hallucination, or inaccurate figure in the document. "The AI made a mistake" is never an acceptable explanation for substandard work.

### 2. Never Upload Protected Information to Unapproved Tools Every business handles sensitive information. Your policy must explicitly list what cannot be entered into public, consumer-facing models: - Customer personal data (names, addresses, phone numbers, payment details). - Non-public financial records, forecasts, or payroll data. - Proprietary source code or product designs. - Legally privileged communications or non-disclosure agreement materials.

If staff need to work with this type of information, they must use your company's approved, protected enterprise environments.

### 3. Verification is Mandatory Generative AI models are designed to generate plausible text, not guaranteed facts. They can invent citations, miscalculate basic sums, and state falsehoods with absolute confidence. Your policy must require staff to manually fact-check outputs, verify calculations, and double-check technical references before sending work to clients or colleagues.

### 4. Respect Copyright and Intellectual Property AI tools should not be instructed to replicate existing copyrighted works, mimic the distinct proprietary style of a specific competitor, or ingest third-party IP without permission. Employees should use AI to synthesise and generate original concepts, not to scrape or recycle protected materials.

Establishing a Simple Traffic Light Framework

To make your policy operational, give your team a simple decision-making model. A traffic light framework works well because it provides immediate clarity without requiring consultation for every routine task.

• Green (Permitted freely): Using enterprise tools for routine administrative work. This includes summarizing public industry articles, drafting internal meeting agendas, brainstorming generic marketing angles, formatting raw code, and editing internal memos for tone and clarity.
• Amber (Permitted with caution and human review): Drafting customer communications, synthesising internal project documentation, analysing internal performance figures (using secured enterprise tools only), and creating first drafts of client-facing deliverables. All output must be thoroughly vetted by a human before distribution.
• Red (Strictly prohibited): Inputting personally identifiable information into consumer tools, generating legally binding advice, using AI to make automated employment or disciplinary decisions, and presenting raw AI output directly to clients without human review.

Rolling Out the Policy

A policy that sits in a forgotten shared folder is useless. To make it stick, follow a clear rollout process:

First, audit what is already happening. Ask your team leaders, without penalty, what tools their teams are currently testing and what tasks they find most repetitive.

Second, provide approved alternatives. You cannot simply tell staff what they cannot do; you must give them safe ways to achieve the same efficiency gains. If you want them to stop using consumer chatbots, equip them with secure commercial tools like Microsoft 365 Copilot.

Third, run a practical 30-minute training session. Walk through real examples relevant to your industry. Show them what a safe prompt looks like versus an unsafe prompt. Show them an example of a plausible-sounding AI hallucination so they understand why human verification is non-negotiable.

What to Do Next

Do not wait for an incident to force your hand. Pull your leadership team together this week and draft a practical, two-page AI policy using the framework above. Once the draft is ready, compare your current software stack against commercial security standards to ensure your staff have access to protected environments. Clear rules, combined with the right enterprise tools, will protect your business while giving your team the productivity gains they are looking for.