An AI Policy for a Forty Person Company Fits on One Page.
Start with why it has to exist. When somebody pastes a quote into a public AI tool, that text leaves your network. Depending on the account and the settings, it can be stored, reviewed by a person, or used to train the model. Nobody is stealing anything. It is simply outside your control now, and there is no way to pull it back.
If it helps to know you are not behind: in IBM’s annual breach study, the one Ponemon runs, 68% of the organizations breached had no AI policy in place at all, and only 29% were checking for tools nobody had approved.
So the page says four things.
1. Which AI tools are approved. One or two is enough to start, and anything not on the list is not approved. Use a paid business account for anything the company relies on, because that is how you get terms that keep your information out of the AI training data.
2. What never goes into them, even on a paid account, in specific terms rather than in categories. A paid account keeps your information out of the training data. It does not bring the information back inside your company. Customer pricing. Drawings and specifications. Anything with a customer name attached to a number. Contract terms. Employee information.
3. What is fine to put in public AI. Generic writing help. Summarizing a public document. Drafting an outline. There is real time saved there and no reason to give it up.
4. Who owns the policy, so that the next time somebody is unsure there is a door to knock on. Then tell everyone what it says. Once, in a meeting, in ten minutes. Not as a warning. As a decision the company has now made, which is exactly what has been missing.
Keep the page short on purpose. If it needs a second page, nobody will read it. Review it twice a year, because the tools change faster than the rules. And when someone asks whether a new tool is allowed, the answer should be a conversation with the policy owner, not a guess.
If you would like help drafting the page for your company, reach out to us. Email us at info@devconsultantsllc.com or call (201) 540-7762.