Build an AI usage policy that actually ships—not a 40-page compliance theater. Define what your team can use, what data stays off-limits, and who approves edge cases.
You are a compliance-savvy operator drafting an AI usage policy for a {{COMPANY_SIZE}} company in {{INDUSTRY}}. Our risk tolerance is {{RISK_LEVEL}}. We currently use {{AI_TOOLS_IN_USE}}.
Generate a policy that covers:
1. **Acceptable Use**: Which teams can use AI for what? (e.g., marketing can use for copy drafts; engineering can use for code review; finance cannot use for customer data).
2. **Data Handling**: What data is off-limits? (PII, customer secrets, financial records, source code). Define the approval gate for edge cases.
3. **Approval Workflow**: Who approves AI use in gray areas? (e.g., manager sign-off for customer-facing content, legal review for contracts).
4. **Liability & Audit**: How do we log AI usage? Who's responsible if an AI output causes harm? What's our clawback process?
5. **Employee Training**: What must every employee know before using AI? One-page checklist.
Format as a policy document ready to post to {{INTERNAL_WIKI_PLATFORM}}. Use plain language. Assume the reader is busy and skeptical. Include a decision tree for "Can I use AI for this?"1. Fill in the {{placeholders}}: company size (startup/scale-up/enterprise), industry (SaaS/fintech/healthcare), risk tolerance (conservative/balanced/aggressive), current AI tools (Claude, ChatGPT, internal LLM), and your wiki platform (Notion, Confluence, GitHub Wiki). 2. Run the prompt through your AI tool of choice (Claude works best for policy language). 3. Copy the output into a Google Doc or wiki page. Spend 20 minutes editing for your specific tools and roles. 4. Share with legal and your leadership team for 48-hour async feedback (not a meeting). 5. Post to your internal wiki with a Slack announcement: "Here's what you can and can't do with AI. Questions? Reply in thread." 6. Revisit quarterly as your tool stack evolves.
{{COMPANY_SIZE}}: Series B SaaS (80 people)
{{INDUSTRY}}: B2B Marketing Automation
{{RISK_LEVEL}}: Balanced (we move fast but care about customer trust)
{{AI_TOOLS_IN_USE}}: Claude, ChatGPT, internal fine-tuned model for customer segmentation
{{INTERNAL_WIKI_PLATFORM}}: Notion**AI Usage Policy – [Company Name]** **1. Acceptable Use by Role** - Marketing: Draft copy, social posts, email sequences. No customer names or account data. - Engineering: Code review, documentation, debugging. No proprietary algorithms or unreleased features. - Sales: Lead research, email templates. No customer financial data or contract terms. - Finance: Expense categorization, report summaries. No customer pricing, payroll, or tax records. **2. Data Handling – The Hard Stop** - Never paste: customer PII, API keys, internal financial data, unreleased roadmap. - Always redact: customer names, email addresses, account IDs. - Approval required: Any use of customer data (even anonymized). Ask your manager first. **3. Approval Workflow** - Green light (no approval needed): Marketing copy, code comments, internal brainstorms. - Yellow light (manager sign-off): Customer-facing content, product copy, external communications. - Red light (legal review): Contracts, terms of service, customer-facing privacy claims. **4. Liability & Audit** - Log AI usage in [Slack bot / spreadsheet / tool]. Include: tool used, task, date, output location. - If an AI output causes customer harm: notify legal within 24 hours. We own the mistake. - Quarterly audit: random sample of logged usage to catch drift. **5. Employee Training Checklist** - [ ] I know what data I can and cannot paste into AI tools. - [ ] I know who to ask before using AI for customer-facing work. - [ ] I understand that AI outputs are drafts, not final products. - [ ] I know how to report misuse or policy questions.