Short answer: Name the approved tools, the data that must never leave the company, who approves new uses, and how mistakes get reported. Keep it to one page, so people actually read it. A policy that bans everything will be ignored, and a policy that allows everything protects nothing.
I'm Vinay Pasricha, founder of GoodSpace AI and author of AI for Business Leaders. Your people are almost certainly using ChatGPT, Gemini or similar tools already, often on their personal accounts. A policy doesn't decide whether AI is used. It decides whether it is used safely.
The four things the policy must say
1. Approved tools. Which tools people may use for work, and on which accounts. Company accounts where possible, because you can control settings and see what is used.
2. Data that must never go in. Be specific. Typical items: customer personal data, employee records and salaries, candidate CVs, unreleased financials, contracts, passwords and access keys, and anything a customer gave you in confidence. If people have to guess, they will guess wrong.
3. Who approves new uses. Someone must own the question "can we use AI for this?" In a small company it might be one person; in a larger one, a small team. Without an owner, every new use is either blocked by fear or adopted without thought.
4. How mistakes get reported. Someone will paste the wrong thing into the wrong tool. Make it easy and safe to say so quickly, so it can be fixed. A policy that punishes reporting guarantees silence.
Match the rules to the stakes
Not every use needs the same control. In the book I use a ladder from Tier 1 (low) to Tier 4 (critical). Drafting a social media post is low. Summarising a customer contract is higher. Anything that decides about a person, money or legal terms is high or critical, and needs a named person to decide. Rate your common uses and write the controls for each tier, rather than one rule for everything.
Connect it to your AI strategy
A policy is defensive. It should sit next to a simple view of what AI is for in your company. I describe three levels: efficiency (doing today's work cheaper), effectiveness (doing it better), and advantage (doing things competitors can't easily copy). If your policy only protects and never enables, people will treat it as an obstacle.
One thing to do this week
Draft the one page with the four headings above. Show it to three people who use AI tools daily and ask what they would actually do differently after reading it. If the answer is "nothing", it is too vague. Then rate your most common uses on the free Risk Ladder tool. If you are deciding who should own all this, read Do You Need a Chief AI Officer?
Where this comes from
This answer draws on two frameworks in AI for Business Leaders: The Risk Ladder and Three Levels of AI Strategy. The book is in hardcover and on Kindle. This is general guidance, not legal advice.
To ask about your own situation, try Ask Vinay's books.
Vinay Pasricha is the founder of GoodSpace AI and the author of six books, including AI for Business Leaders.
