Write an AI policy your team can use.

Nine answers that make an AI policy usable.

Ask your team which tools they already use and what work those tools help them do. Then write a short policy they can act on. Name a person who can answer questions and approve exceptions.

1. Which tools are approved? Record the exact product and tier, allowed tasks, and the process for requesting another tool.
2. What data is allowed? Name prohibited and restricted categories in familiar terms: credentials, client records, health information, or material under NDA. Document approved exceptions.
3. Who owns the decision? Name an accountable owner and an executive sponsor, with a route for security and legal review.
4. What must a person check? Define review before external publication or consequential action. Assign responsibility for accuracy, sources, permissions, and confidential information.
5. What laws and contracts matter? Review the actual use case, people affected, data, sector, and locations. Do not assume a generic AI policy settles these questions.
6. How will people learn it? Practice with the team's real tasks, including a bad answer and an inappropriate data request. Show how to ask for help.
7. How are problems reported? Provide a prompt, no-blame route for accidental disclosure, unexpected behavior, or an incorrect output that has already been used.
8. What must vendors provide? Review processing terms, retention, training use, access, subprocessors where relevant, and how changes will be communicated.
9. How does access end? Revoke integrations, close accounts, and handle export or deletion when a tool or employee leaves.

Put the policy into the workflow.

A written rule needs matching access settings and a practical approval route. Review connected applications, permissions, and offboarding in the workspace series. Revisit the policy after an incident, a material vendor change, or a new use case.

Use page 12 of the workbook to draft the answers. Start with the approved tools, prohibited data, reviewer, and named owner. Keep technical implementation details in a supporting checklist so the policy itself remains readable.

Reference: NIST AI Risk Management Framework. It is a voluntary risk-management resource, not a certification or a statement of legal compliance. This guide is educational and does not replace legal advice.