Your people are already using AI at work. The only question is whether they’re doing it with rules or without them. Microsoft and LinkedIn’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work, and the figure is 80% at small and medium-sized companies.
Most of that use is well meant: someone tidying a spreadsheet, drafting an email or summarising a long report. The risk is what goes into the tools. IBM’s 2025 Cost of a Data Breach Report found that one in five organisations had a breach involving shadow AI, that heavy shadow AI use added an average of $670,000 to breach costs, and that 63% of breached organisations had no AI governance policy or were still writing one.
A good AI usage policy doesn’t need to be long. It needs to be clear enough that people follow it. Below is a one-page template you can copy, followed by how to roll it out and how to tell whether it’s working.
What an AI usage policy is (and isn’t)
An AI usage policy tells staff which AI tools they can use for work, what they can and can’t put into them, and what to do when they’re unsure. That’s it.
It is not a technical document, and it shouldn’t read like one. If people need a lawyer to understand it, they won’t follow it. It also isn’t a ban. Policies that say “no AI” push people towards personal accounts on their phones, where nobody can see what’s happening.
The five things every AI policy needs
- Approved tools. A short list of AI tools people can use for work, and how they sign in to them.
- What never goes in. The kinds of data that must never be pasted or uploaded into an AI tool, in plain examples.
- Work accounts only. Company data goes into company accounts, not personal ones.
- A person checks the output. AI gets things wrong. Someone is responsible for anything that leaves the business.
- How to ask. Who to ask about a new tool, and how quickly they’ll answer.
Everything else is detail.
The one-page AI usage policy template
Copy this, replace the bracketed parts, and cut anything that doesn’t fit your business. This template is a starting point, not legal advice. If you work in a regulated field, have it reviewed.
[Company name] AI usage policy
Version 1.0 · Owner: [name, role] · Next review: [date, six months from now]
Why we have this policy. AI tools help us work faster. They also make it easy to share information we’re responsible for protecting. This policy explains how to use AI safely.
1. Tools you can use. You can use these AI tools for work: [for example, Microsoft 365 Copilot, a business plan of ChatGPT, Gemini for Google Workspace]. Sign in with your work account. If a tool isn’t on this list, ask [contact] before using it for work. We aim to answer within [two working days].
2. What you must never put into an AI tool.
- Client or customer personal information: names with addresses, ID numbers, health or financial details.
- Passwords, API keys, or anything that grants access to a system.
- Payroll, HR records or salary information.
- Contracts, legal documents or anything marked confidential.
- Client data that we hold under an agreement, unless that agreement allows it.
If in doubt, leave it out, or ask.
3. Work accounts only. Never use a personal AI account for company data. Personal accounts aren’t covered by our agreements with AI vendors, and we can’t get the data back.
4. Connecting AI apps. Don’t connect an AI app, browser extension or note-taker to your work email, calendar or files unless it’s on the approved list. These connections can read far more than you expect.
5. Check what AI gives you. You’re responsible for anything you send, publish or act on, even if AI wrote it. Check facts, figures and names before they leave the business. Don’t present AI output to a client as checked advice unless you’ve checked it.
6. AI agents. Tools that act on your behalf, such as sending emails, editing files or making purchases, need approval from [contact] before use, and each one needs a named owner.
7. If something goes wrong. If you think you’ve put something into an AI tool that you shouldn’t have, tell [contact] straight away. You won’t be in trouble for reporting it. The sooner we know, the more we can do.
8. Reviews. We review this policy and the approved tool list every [six months], or sooner when a new tool is requested.
I have read and understood this policy. Name: ______ Date: ______
A worked example: the spreadsheet that didn’t leave
Here’s an illustrative example at a 50-person accounting firm, before and after a policy.
Before. A senior bookkeeper wants to clean up a messy payroll export before month-end. She opens a free AI chatbot on her personal account, uploads the file, and gets a tidy version back in seconds. It works. Nobody knows it happened, including her manager. The firm’s payroll data, with names, salaries and bank details, now sits in a personal account it has no agreement with.
After. The firm adopts the one-page policy and approves its Microsoft 365 Copilot licence for this kind of task. A month later the same bookkeeper goes to drag a payroll file into a personal chatbot. A short note appears: personal AI accounts aren’t approved for company data, and here’s the link to the approved tool. She uses Copilot instead. Her manager gets a one-line summary. Nothing leaves the business, and nobody had to ban anything.
The policy alone didn’t change her behaviour. The policy plus a nudge at the right moment did.
How to roll it out in a week
- Day 1: Find out what’s actually in use. Ask your team, and check which AI apps are connected to your Microsoft 365 or Google Workspace accounts. Most businesses find more than they expected.
- Day 2: Pick the approved tools. Choose one or two that cover most needs, with work accounts.
- Day 3: Fill in the template, name an owner and set a review date.
- Day 4: Send it with a short note explaining why, and a link to the approved tools.
- Day 5: Remove AI app connections nobody needs, and say why.
Keep the first version short. You can add detail once people are following it.
How to tell if the policy is working
A policy nobody follows is a document, not a control. Look for:
- Fewer personal AI accounts used on company devices.
- Fewer unknown AI apps connected to mail and files.
- More requests to add tools to the approved list. That’s a good sign: people are asking instead of working around it.
- Reports from staff when they’ve made a mistake.
For the detection side, read shadow AI detection.
Checklist: is your AI policy ready?
- It fits on one page and uses plain words.
- It lists the approved AI tools and how to sign in to them.
- It gives clear examples of data that must never go into an AI tool.
- It says company data goes into work accounts only.
- It covers AI apps and browser extensions connected to mail and files.
- It says a person checks AI output before it leaves the business.
- It covers AI agents that act on someone’s behalf, each with an owner.
- It tells people who to ask, and how quickly they’ll hear back.
- It makes reporting a mistake safe.
- It has an owner and a review date.
How Centeye helps the policy stick
Centeye Lumen is the AI governance and registry platform. It finds which AI tools are in use and by whom, and sees when company data is pasted or uploaded into an AI tool, including from personal accounts, without reading the content. It lists every AI app connected to mail, files and calendars, and what each one can reach.
When someone is about to break the policy, Lumen shows a short note explaining the rule and points them to the approved tool. On the rules you set, it can block an AI site or browser extension, or revoke an app’s access, and every revoke can be undone. Every AI tool lands in one register with an owner and a review date, so your approved list stays current instead of going stale in a shared drive.
For AI agents, Centeye Synthwatch, in early access, gives every agent an owner and an off switch.
Frequently asked questions
Do small businesses really need an AI usage policy?
Yes. Microsoft and LinkedIn found that 80% of AI users at small and medium-sized companies bring their own AI tools to work. Without a policy, every person makes up their own rules.
Should we just ban AI tools?
Bans tend to push use onto personal phones and accounts, where nobody can see it. Approving a good tool and setting clear rules usually works better.
What’s the difference between an AI usage policy and AI governance?
The policy is the rules for people. AI governance is the wider job: knowing every AI tool and agent in use, giving each an owner and a review date, and acting when the rules are broken. Read AI governance for regulated industries for more.
How often should we review it?
Every six months is a sensible starting point, and whenever someone asks to add a new tool. AI tools change fast.
Is this template legal advice?
No. It’s a practical starting point. If you work in a regulated field or handle sensitive client data under contract, have it reviewed before you adopt it.
New to the terms above? Read what shadow AI is, or see our security glossary. Want to see which AI tools your team already uses? Start a free trial.
Figures cited from the Microsoft and LinkedIn 2024 Work Trend Index and the IBM 2025 Cost of a Data Breach Report. The template is a starting point, not legal advice. The worked example is illustrative.