How to write an AI use policy for your business

An AI use policy tells your team which tools they can use, what information belongs in them, and who reviews the result. This is a writing guide, not a completed policy or a compliance certification. Adapt it to your business and have the appropriate people review it.

Name the approved tools and owners

List the actual tools and account tiers the business has reviewed. Name the person responsible for approving a new one. Record the applicable data-handling terms; do not assume every paid account permits every type of information.

Define what information may be used

Set rules for client records, employee information, financial data, credentials, confidential documents, and other sensitive material. Explain where approved work may happen and where it may not. A policy should give staff a practical route to ask when they are unsure. Healthcare and dental practices also need to say which tools are covered by a business associate agreement; see which ChatGPT plans come with a BAA.

Assign review and approval

Name who checks a draft and who authorizes an action. State how errors, unexpected outputs, or suspected disclosure are reported. The person responsible for a client deliverable must be able to inspect the source information and correct it.

Use work accounts and review access

Identify who administers accounts, removes access when roles change, and reviews the approved-tool list. Set a review date and revisit the policy when tools, client requirements, or workflows change.

Connect the policy to the work

A policy can clarify usage but does not tell you which automation is worth building. The Edgerton assessment measures work over ten business days, with agreed scope and staff consent. It helps identify repeated tasks, useful connections, and AI usage that needs attention.

If you commission a build, the proposal and documented access controls govern the resulting EdgeKeeper system. A written policy supports those controls; it does not replace them.