How to Write an AI Policy Your People Will Actually Follow

Many companies now have an AI policy. Far fewer have one their people actually follow. The usual reasons: it’s too long, too vague, too strict or written in language only a lawyer could love.

A good AI policy does three things. It tells people which tools they can use, what they must never do, and who is responsible for the result. Here’s how to write one that works.

Why AI policies get ignored

• Too long. If it takes 30 minutes to read, most people won’t.
• Too vague. “Use AI responsibly” doesn’t tell anyone what to do on a Tuesday afternoon.
• Too strict. Ban everything and people will quietly use AI anyway, which is how shadow AI starts.
• No training. A policy nobody has been shown how to apply is just a document.

The 7 parts of an AI policy people follow

1. Purpose, in one paragraph

Explain why the policy exists: to help people use AI to work faster and better, while protecting the company, clients and colleagues. Start with the benefit, not the threat.

2. Approved tools

List the AI tools people may use for work, and how to request a new one. Keep the list short and make the approved tools easy to access.

3. Data rules: the traffic light

The simplest way to explain what can be shared with AI:

• Green: public information and general questions. Fine in approved tools.
• Amber: internal information. Approved tools only, with care.
• Red: client data, personal data, financials, contracts and passwords. Never in AI tools unless specifically approved.

4. Human review

AI drafts; people decide. Anything that goes to a client, regulator or the public must be checked by a person. This isn’t theoretical: in 2023, lawyers in the US case Mata v. Avianca were fined $5,000 after filing a brief with fake cases invented by ChatGPT, and in 2025 Deloitte Australia agreed to partially refund a government client after a report was found to contain AI-generated errors.

5. Accountability

Make it simple: you own what you send. Using AI doesn’t change who is responsible for the work.

6. Transparency

Say when AI must be disclosed (for example, in client deliverables or published content), and when it doesn’t need to be.

7. Training, support and review

Name who people can ask for help, make training part of the rollout, and set a date to review the policy, because AI tools change quickly.

Rolling it out so it sticks

1. Write it with the people who’ll use it. Ask a few team leads what’s confusing before you publish.
2. Train, don’t just email. Walk teams through the policy using their real tasks.
3. Back it up with SOPs. Turn the policy into step-by-step procedures for common tasks, so following the rules is the easy path.
4. Review it regularly. Update the approved tools list and rules as your needs and the tools change.

The best AI policy is short enough to remember, clear enough to act on and backed by training that shows people how.

The bottom line

An AI policy is the governance step that turns AI from a risk into a routine. Keep it short, make it practical and pair it with training and SOPs, and your people won’t just follow it; they’ll be glad it exists.

Sources: Bloomberg Government on Mata v. Avianca (2023) · CTV News / AP on Deloitte Australia (2025)