AI policy and governance
The employee handbook for your digital staff.
Your people have rules for how to work with customers, money, and equipment. AI needs the same. We write a short, plain-English policy your team will actually follow.
Why now
Staff are already using AI.
That is not a problem on its own. The risk is that nobody has told them what is safe.
An employee pastes a customer list into a free chatbot to save time. Another uses AI to write a contract clause and sends it unchecked. Nobody meant any harm. Nobody was told the rules, because there were none.
A policy fixes that. It gives people clear permission for the good uses and clear limits on the risky ones.
What a good AI policy covers
Eight things, in plain English.
Approved tools
Which AI tools staff may use, and for what. Everything else needs a quick yes first.
Data rules
What information never goes into an AI tool: customer lists, health records, financial details, trade secrets.
Human review
Which work a person must check before it leaves the building, such as quotes, contracts, and anything customer-facing.
Vendor vetting
The questions to ask before you adopt a new AI product: where data goes, who can see it, and how to leave.
Accountability
Who owns AI decisions, who answers questions, and who to tell when something goes wrong.
Customer disclosure
When and how you tell customers that AI was involved.
Training
How new hires learn the rules, and how everyone stays current as the tools change.
Review schedule
A date to revisit the policy. AI changes quickly, so a policy needs a check-up.
How a policy review works
Three simple stages.
1. Find out what is real
We talk with a few of your people and learn which AI tools are in use and why. No blame.
2. Write it down
We draft a short policy in plain English, plus a one-page summary for staff.
3. Make it stick
We brief your team, answer questions, and set a date to review the policy again.
Common questions
Questions we hear.
Does my business need an AI policy?
If anyone on your team uses AI, even occasionally, yes. A policy does not need to be long. It needs to tell people what is allowed, so they are not guessing.
How long should a policy be?
Short enough that people read it. Ours run a few pages, written in plain English, with a one-page summary for staff.
Is this legal advice?
No. We are consultants, not a law firm. If you work in a regulated field such as health or finance, or have contract obligations, have your attorney review the final policy.
We already use AI quietly. Is that a problem?
It is common, and it is fixable. We start by finding out what is actually in use, without blame, then write rules that fit how your team works.
Start with a policy review.
Tell us how your team uses AI today. We will tell you what we would write, and what it would take.