AI-first company

Governance and risk · Adopt

Write a one-page AI-use policy staff will actually read

Put the rules for AI on one page: which tools are allowed, what must never be typed in, who checks the output, and who to ask. Then build the most important rule into the work itself, because a page alone gets ignored.

By
Last reviewed
Corrections
Report an error
When Do first. Before you start with AI, or as you start.
Effort Low (days, one person)
Evidence Common practice

Regulators recommend it and four documented cases bear on it. No study has compared companies with and without a policy, and one case shows a policy being ignored.

Fits
Industries All industries
In the guide Medium-sized businessesRoles and leadership

What it is

Write a single page that every member of staff reads. The page answers five questions:

  1. Which AI tools may I use for work?
  2. What must I never put into them?
  3. What must a person check before AI output is used?
  4. When do I have to say that AI was used?
  5. Who do I ask, and who do I tell when something goes wrong?

Staff are almost certainly using AI tools already. The page tells staff how to use the tools safely.

What the evidence shows

Four documented cases are the basis for this advice. No study has tested it.

  • Without rules, staff decide for themselves. At a government department in Australia, almost 13% of staff had opened ChatGPT before any rule existed. One worker typed details of a child protection case into ChatGPT. The privacy regulator found “no departmental rules in place about when and how these tools should or should not be used”.
  • A general IT policy does not count. The same department pointed to its technology-use policy and privacy e-learning. The regulator called these “far from sufficient”. The regulator expected rules written for AI tools.
  • A policy alone can be ignored. A US law firm required written approval before anyone used ChatGPT for legal research. A partner used it anyway and filed five made-up citations. He told the court he knew the rule.
  • Rules work better inside the tool or the process. Another law firm had trained staff, and one lawyer still filed eight made-up cases. The firm then added a notice inside its AI tool that each user must accept: “users must independently verify” the output. The first firm brought in a check before every court filing.
  • Regulators ask for it. Australia’s privacy regulator says organizations “should establish policies and procedures for the use of AI systems”.

How to do it

  1. List the tools that are allowed. Name them. Say that anything not on the list needs a yes from a named person first.
  2. Say what never goes in. See decide what data may go into which AI tools. Put the rule in one sentence staff can remember.
  3. Say what a person must check. At the least: anything sent to a customer, and anything with legal or financial weight. See keep a person checking.
  4. Say openly where using AI is expected. This answers question 4 from the staff side. In four experiments with 4,439 people, people who used AI at work were judged less competent and less motivated than people who did not. The study also found that people expect to be judged this way. If the page says when AI is expected and when to say it was used, staff have less reason to keep their use quiet.
  5. Name the contact. One person for questions, and the same person to tell when something goes wrong.
  6. Keep it to one page. Write it in the words your staff use. Cut anything that does not change what someone does.
  7. Take the top rule off the page and into the work. Add a line to the sign-off checklist, a notice in the tool, or a block on uploads. Choose the rule whose breach would hurt most.
  8. Give it to everyone, including temporary staff and contractors. Go through it in a team meeting. Ask each person to confirm they have read it.
  9. Review it every six months, and whenever you add a tool.

What to measure

  • The share of staff, including temporary staff, who have confirmed they read the page.
  • The number of questions that reach the named contact. None at all usually means the page is not being used.
  • The number of incidents, and how each was found.

Where it fails

  • The policy is long. A ten-page policy is filed and forgotten.
  • The policy only forbids. Staff who are told only what they may not do will use the tools quietly. Say what is allowed.
  • The policy depends on memory. The law firm’s rule was clear and known, and a senior person still broke it. As of 16 October 2026, one researcher’s database lists 871 court decisions involving lawyers who filed AI-invented material, after bar guidance and firm policies existed. Put a check in the process.
  • Senior people are exempt in practice. In the law firm’s case, the person who broke the rule helped lead the group the rule applied to.
  • The policy covers employees only. At an Australian state agency, a temporary worker uploaded a file with data on 2,031 people.

By company size

  • Micro and small: the owner writes the page in an hour and talks it through with the team.
  • Medium: the AI owner writes it, and each team lead adds the one check that matters most in their work.
  • Mid-market and enterprise: one company-wide page, with short additions for teams that handle sensitive data. Technical blocks back up the most important rules.

Company cases

Companies that did this

Companies that came round to it

Sources

  1. Reif, Larrick and Soll (2025). Evidence of a social evaluation penalty for using AI. Proceedings of the National Academy of Sciences, 122(19), e2426766122. What this study did and found
  2. Office of the Australian Information Commissioner (October 2024, updated January 2025). Guidance on privacy and the use of commercially available AI products. oaic.gov.au
  3. Office of the Victorian Information Commissioner (September 2024). Investigation into the use of ChatGPT by a Child Protection worker. ovic.vic.gov.au
  4. Charlotin, D. AI Hallucination Cases database (counts as of 16 October 2026). damiencharlotin.com