How to write a company AI policy your staff will actually follow
A company AI policy tells staff which AI tools they may use, what information they may enter, how results must be checked and who to ask when unsure. The best policies are short and written in plain language. Its job is not to ban AI, but to let people use it without putting customers, colleagues or the business at risk.
Say why the policy exists
Start with a few lines of plain purpose: the company wants staff to use AI where it helps, and wants customers, employees and company information protected while they do. People follow rules they understand.
List the approved tools
Name the tools staff may use and the accounts they must use them with. Explain how to request a new one. A clear route for requests discourages people from quietly using whatever they find.
Draw a clear line around data
This is the most important section. Give concrete examples of what must not go into an unapproved AI tool: customer details, employee and payroll records, contracts, passwords, unpublished financial information and anything confidential to a client. Examples work better than abstract categories.
Keep a person responsible for the result
AI can be confidently wrong. The policy should say that whoever uses the output remains responsible for it, and that facts, figures, legal wording and anything sent to a customer must be checked first.
Decide when AI must be disclosed
Customers talking to an automated agent should know it is automated. Decide too whether AI use must be noted in client work or internal reports. Some clients and sectors will have rules of their own.
Protect decisions about people
Decisions about hiring, discipline, pay, credit or similar matters should not be left to AI alone. State that a person makes them and can explain them.
Name an owner and keep it alive
Name who owns the policy, who staff should ask, and how a mistake or data leak gets reported, without fear of punishment for speaking up early. Review it whenever the tools or the business change. Have your legal adviser check it against the Cyber and Data Protection Act [Chapter 12:07] and your employment arrangements. This article is general information, not legal advice.
Questions buyers ask
Should a company ban ChatGPT and similar tools?
A complete ban is hard to enforce and tends to push use onto personal phones, where you cannot see it. Approving suitable tools and setting clear data rules is usually safer.
How long should an AI policy be?
Short enough that staff will read it. Plain rules and real examples matter more than length.
Who should write the AI policy?
Someone senior should own it, with input from the people who use the tools, whoever manages IT and security, and your legal adviser.
Book an AI readiness briefing
A 15-minute discussion with our team in Harare about governance, security, policy and where to start. Email sales@eigenstatesystems.com or message us on WhatsApp at +263 77 636 6999.