Draft an Internal AI Usage Policy for Your Company

Full prompt

You are a business operations and compliance advisor. Draft a comprehensive internal AI usage policy for {{company_name}}, a {{company_size}} company in {{industry}}.

The policy should be clear, enforceable, and appropriate for our risk tolerance ({{risk_tolerance}}).

Include these sections:
1. **Purpose & Scope** – Who this applies to and why it exists.
2. **Approved AI Tools** – List {{approved_tools}} as permitted for business use.
3. **Prohibited Uses** – Specific restrictions (e.g., no customer PII in prompts, no confidential strategy).
4. **Data Security & Privacy** – Requirements for data handling, retention, and third-party tool vetting.
5. **Employee Responsibilities** – Training, reporting, and accountability.
6. **Liability & Indemnification** – Company's position on AI-generated output accuracy and IP ownership.
7. **Review & Updates** – Policy review schedule (suggest quarterly or biannual).
8. **Enforcement** – Consequences for violations.

Tone: Professional, clear, non-legal-jargon where possible. Assume employees have basic AI familiarity but may not understand governance.

Format: Use headings, bullet points, and short paragraphs for scannability. Include a one-page summary at the top.

How to use

1. Fill in your company details (name, size, industry, risk tolerance). 2. List any AI tools you've already approved or plan to approve; the prompt will adapt recommendations. 3. Run the prompt and review the draft policy. 4. Customize sections to match your actual tech stack, data sensitivity, and compliance requirements (HIPAA, GDPR, SOC 2, etc.). 5. Share with your legal advisor or compliance officer for final review. 6. Publish internally and schedule a policy review meeting with leadership and key teams. 7. Set a calendar reminder to revisit the policy quarterly or when new AI tools are adopted.

Customization tips

• Add industry-specific restrictions: healthcare teams should prohibit PHI in any external AI tool; fintech should restrict PII and transaction data; legal teams should flag attorney-client privilege concerns.
• Adjust approval workflows: conservative companies should require IT sign-off for new tools; moderate companies can allow team leads to request tools; permissive companies can use an opt-out model.
• Include your actual compliance requirements: reference HIPAA, GDPR, CCPA, SOC 2, ISO 27001, or industry standards relevant to your business.
• Specify data retention policies: clarify whether employees can use cloud-based AI (with DPA) or only self-hosted tools.
• Define escalation paths: who approves exceptions? Who investigates violations? Who owns policy updates?
• Add a sunset clause: specify when the policy will next be reviewed (e.g., 'This policy will be reviewed on Q2 2025 or when 3+ new AI tools are adopted, whichever comes first.').
• Tailor the tone to your culture: a startup may use casual language; a regulated industry should use formal, precise language.
• Include examples: add 2–3 real scenarios (e.g., 'Using ChatGPT to draft a customer email is OK; using it to summarize a customer's private data is not.').