Does Your Organisation Need an AI Policy? 7 Areas to Cover

If employees use AI for work, your organisation needs clear rules governing that use. An effective AI policy explains which tools are approved, what data employees can share, when human review is required and who is accountable. Start with practical guidance developed jointly by HR, IT and compliance, then strengthen it as AI use expands.

Key takeaways:

• An AI policy establishes clear expectations for the responsible use of artificial intelligence at work.
• Unapproved AI use can expose confidential information, introduce inaccurate outputs and leave responsibilities unclear.
• Cover seven essentials: tools, data, human review, disclosure, approvals, incidents and policy review.
• Give the policy a named owner, with input from HR, IT, security, legal and compliance.
• Use ISO/IEC 42001 and the NIST AI Risk Management Framework to inform broader governance arrangements.

What is an AI policy, and why does your organisation need one?

An AI policy is a documented set of rules explaining how employees and other authorised users may use artificial intelligence for work. It defines acceptable activities, restrictions, approval requirements and responsibilities.

Your organisation should establish one when people use AI to create content, analyse information, support decisions or carry out business tasks. The policy should cover everyday use of external tools as well as AI capabilities built into existing business software.

Consider a familiar situation. A client needs a summary of a lengthy contract by the end of the afternoon. An employee uploads the document to a personal chatbot account, edits the summary and sends it.

The task is completed, but several questions remain unanswered. Was the tool approved? Could the employee share that contract with the provider? Who checked whether the summary preserved the important clauses?

Without written guidance, individual habits fill the gap. A workplace AI policy gives employees a clear basis for making those decisions.

Why unapproved AI use creates governance risks

Shadow AI means AI tools or activities used without the organisation’s approval or oversight. It can include personal chatbot accounts, browser extensions and AI features connected to business information without review.

Employees may adopt these tools to save time or manage demanding workloads. Clear rules and accessible approved alternatives help address that need while establishing appropriate controls.

Three risks deserve particular attention.

Confidential information shared with unsuitable tools

Employees may enter contracts, customer details, financial information or internal documents into tools that have not been assessed.

How that information is processed, retained or used depends on the provider, service terms, account type and settings. Your policy should require those arrangements to be checked before sensitive information is shared.

Inaccurate outputs used in business decisions

Generative AI can produce confident statements that are factually incorrect, including misleading explanations or invented references. NIST identifies this risk as confabulation.

For example, an AI-generated summary might omit an exception from a contract or misrepresent a requirement. If nobody verifies the output, the error can influence subsequent work.

Unclear ownership when something goes wrong

An incident becomes harder to manage when nobody knows who approved the tool, reviewed the output or owns the response.

A policy should establish those responsibilities before a problem occurs. These controls form part of the broader oversight addressed in Excentra’s AI Governance, Risk & Responsible AI Training Courses.

What should an organisational AI policy include?

A useful first policy should cover seven areas. Keep the main document concise, with supporting procedures where employees need more detailed instructions.

1. Approved AI tools and authorised accounts

List the tools employees may use, the activities approved for each tool and the accounts they must use.

Approval should be specific. A tool authorised for drafting public-facing content may not be approved for processing confidential contracts or employee information.

Explain how employees can check the current approved-tool list and request access. Make the rules for personal accounts and unapproved tools explicit.

2. Permitted data and information restrictions

State which information employees may enter into each approved tool.

Use familiar categories, such as public information, internal documents, confidential business information and personal data. Explain what requires additional approval and what must not be uploaded.

Tool approval alone should not authorise every type of data use. Employees also need to respect existing access permissions, confidentiality commitments and information-handling rules.

For professionals responsible for these controls, the Data Governance, Privacy & Integrity in Artificial Intelligence (AI) training course examines data responsibilities, privacy risks and safeguards across AI use.

3. Human review and decision-making responsibilities

Define which AI outputs require review, who performs it and what they must check.

For important work, reviewers should verify relevant facts, calculations, references and source material. They should also consider whether the output is appropriate for its intended audience and purpose.

Set explicit approval requirements for consequential uses, including decisions affecting people and outputs relied on for legal, financial or safety matters.

The person reviewing the work needs sufficient knowledge, time and authority to question or reject it.

4. Disclosure and transparency

Explain when employees must disclose that AI has contributed to an output or interaction.

Your rules should reflect the context, applicable requirements and reasonable expectations of customers, colleagues and other stakeholders. Examples may include communicating with an automated assistant, producing a client deliverable or publishing substantially AI-generated material.

Provide straightforward examples so employees understand when disclosure is necessary and how to word it.

5. Approval of new tools and uses

Name the role or group authorised to approve a new AI tool or a significant change in how an existing tool is used.

Provide a simple request route covering:

• The business purpose.
• The proposed tool and account.
• The information involved.
• The people affected.
• The proposed review and risk controls.

Require reassessment when the activity changes materially. Drafting an internal note and automatically sending customer communications involve different responsibilities, even when they use the same technology.

6. Incident reporting and response

Explain how employees should report inappropriate data sharing, harmful outputs, unauthorised actions or complaints involving AI.

Identify the reporting contact and the team responsible for investigating. Give clear instructions on pausing the affected activity and preserving relevant records without spreading sensitive information further.

Encourage prompt reporting. Employees should understand that reporting a concern helps the organisation contain problems and improve controls.

7. Policy ownership and review

Assign a named policy owner, an approving authority and a review date.

A six-month review cycle may be a practical starting point, depending on your organisation’s risk and pace of adoption. Review sooner after a significant incident, a major tool change or a new type of AI use.

Keep a version history and explain how updates will be communicated.

Who should write and own the AI policy?

Develop the policy collaboratively, then assign clear accountability for maintaining it.

Each function contributes a different perspective:

• HR connects the rules with employee responsibilities, training needs and workplace conduct.
• IT and information security assess tools, account controls, integrations and technical safeguards.
• Legal, compliance and privacy specialists assess relevant obligations, confidentiality requirements and information-handling risks.
• Business process owners explain how AI will be used in practice and where operational controls are needed.

Ask representative managers and employees to test the draft against realistic tasks. Could they identify the approved tool, decide which information they may use and find the right reviewer?

Where the answer is unclear, improve the guidance before publication.

Is a two-page AI policy enough?

A two-page policy can be a useful starting point for straightforward, limited AI use. Its adequacy depends on the activities, information and risks involved.

A concise main policy may need supporting documents, including an approved-tool register, data-handling guidance, approval procedures and incident instructions.

More detailed controls are needed as AI becomes embedded in important processes, takes actions through connected systems or influences consequential decisions.

Document length is a poor measure of protection. Assess whether employees can follow the rules and whether the organisation can demonstrate that the controls operate effectively.

How ISO/IEC 42001 and the NIST AI RMF support AI governance

Two recognised references can help organisations develop governance beyond an initial acceptable-use policy.

ISO/IEC 42001 specifies requirements for establishing, maintaining and continually improving an AI management system. It addresses organisational arrangements for governing AI-related risks and opportunities. A short employee policy can contribute to that system, but does not establish conformity with the standard by itself.

The NIST AI Risk Management Framework is a voluntary resource organised around four functions: Govern, Map, Measure and Manage. These functions support continuous risk management throughout the AI lifecycle; they are not simply four sequential implementation steps.

Use these references to inform responsibilities, assessments, documentation and monitoring. Apply them alongside the requirements relevant to your organisation and its activities.

Put your AI policy into everyday practice

Before publishing the policy, confirm that employees have access to approved tools, understand the review requirements and know where to ask questions.

Support the launch with practical examples: summarising a contract, drafting a customer response, analysing employee information and checking an AI-generated recommendation.

For employees using content-generation tools, Excentra’s Generative AI Training Courses can complement policy guidance by developing their understanding of AI capabilities and limitations.

Monitor how the policy works. Review approval requests, reported incidents and recurring questions, then use that evidence to improve the guidance.

Strengthen your AI policy and governance capabilities

Excentra offers relevant training courses for professionals responsible for AI oversight:

• Artificial Intelligence (AI) Governance, Risk and Compliance — Examine governance structures, accountability, risk assessment and responsible AI controls, including their integration into wider organisational oversight.
• Artificial Intelligence (AI) Standards and Risk Management Frameworks (RMF) — Explore recognised ISO/IEC standards and the NIST AI Risk Management Framework, including approaches to bias, privacy, transparency and system robustness.

These training courses support professionals moving from initial AI-use rules towards more structured governance and risk management.