Your team is already using AI. Some of it is in tools you pay for, such as the assistant built into your email, documents or accounting software. Some of it is a free chatbot on someone’s phone, signed in with a personal account. The question isn’t whether people use AI at work. It’s whether they know what’s allowed.

A good AI use policy answers that in a few minutes of reading. A bad one either bans everything, so people quietly ignore it, or says so little that everyone guesses.

Why most AI policies get ignored

We see the same problems again and again:

  • It only says no. A policy that bans AI outright doesn’t stop people using it. It just stops them telling you.
  • It doesn’t name any tools. “Use approved tools” is no help if nobody knows which tools are approved.
  • It’s written for lawyers. Ten pages of definitions don’t help someone deciding, at 4pm on a Friday, whether they can paste a client email into a chatbot.
  • There’s no way to ask. People hit a grey area and have nobody to check with.
  • It never changes. AI tools change every few months, and a policy written last year is already out of date.

What the official guidance expects

You don’t have to invent this from scratch. MBIE’s responsible AI guidance for businesses, published in July 2025, describes usage policies as a good way to set out an organisation’s stance on AI. It suggests saying which tools are endorsed and how they can be used, training staff, and having people review high-stakes outputs, such as anything affecting money, health or legal matters.

The Privacy Commissioner has also set out expectations for using generative AI. They include senior leadership approval before a tool is used, a privacy impact assessment, being open with customers about how AI is used, a person reviewing outputs before acting on them, and not putting personal or confidential information into a tool unless the provider has confirmed it won’t be retained or disclosed.

Your policy is how those expectations turn into everyday behaviour.

Start with a traffic light for data

Most of the risk comes from what goes into the tool. A simple traffic light covers most decisions:

  • Green: fine in any approved tool. Public information, general research, and your own drafts with no client or staff details.
  • Amber: approved business tools only. Internal information such as pricing, plans, financials and supplier terms. Only in tools the business has signed up for, under terms that say your data isn’t used to train the provider’s models.
  • Red: not without an approved process. Personal information about clients or staff, bank and account numbers, health information, and anything covered by a confidentiality agreement. If there’s a genuine need, set up a process for it, such as removing identifying details before anything reaches the AI tool.

People remember three colours. They don’t remember twelve data classifications.

Name the tools, and the accounts

List the AI tools people can use, and how to get access. Just as important, say which accounts. Work accounts, set up and managed by the business, come with the business’s terms and controls. Personal accounts on free tools come with whatever terms the user clicked through, which is a common way data leaks out.

A simple rule works well: no work information in personal AI accounts, ever. If a tool is useful enough that people want it, that’s a signal to approve it properly.

Make the person responsible for the output

AI tools can be confidently wrong. They invent figures, misquote sources and miss context. Your policy should be clear that whoever uses AI owns the result. If it goes to a client, a supplier or into your records, a person has checked it first.

Say what checking means for your business. Numbers are verified against the source system. Quotes and references are opened and read. Anything legal, financial or contractual gets the same review it would get if a junior staff member had written it.

Cover agents, not just chat

Policies written in 2023 assumed AI meant a chat window. Increasingly it means tools that act: sending emails, updating records, booking meetings or moving files. That needs its own rule. Anything that can take an action on the business’s behalf is approved by the policy owner before it’s switched on, starts with the smallest permissions that will do the job, and has a person approving anything that sends money, changes core records or contacts customers.

Give people a way to ask

Name a policy owner. In a small business that might be the operations manager or whoever looks after IT. Give people one easy way to ask “can I use this for that?” and to request a new tool. Every question that comes in shows you where the policy is unclear.

A one-page policy outline

Aim for something that fits on a single page. Use these headings:

  1. Purpose. Two sentences on why the business uses AI and what the policy protects.
  2. Approved tools. Each tool, what it’s for, and how to get a work account.
  3. The data traffic light. Green, amber and red, with examples from your own business.
  4. Never. A short list: no red data without an approved process, no personal accounts for work, no AI-generated content sent out unchecked.
  5. Checking the output. Who is responsible, and what checking means.
  6. Telling clients. When and how you’ll be open about using AI in their work.
  7. Agents and automation. Approval before any tool can act on the business’s behalf.
  8. Questions and requests. The policy owner, and how to ask.
  9. Review date. At least every six months, and whenever you add a major tool.

Rolling it out

A policy nobody reads changes nothing. Walk the team through it in a short session using real examples from your own work: a client email, a pricing spreadsheet, a draft proposal. Show which colour each one is and which tool to use. MBIE’s guidance also recommends training for everyone, with extra depth for anyone building or governing AI, and regular refreshers.

Then watch what comes in. The first month of questions will tell you more about how AI is really used in your business than any survey.

This is general information, not legal advice.

Where to start

Find out which AI tools are already in use, including the free ones, then draft the one-pager and test it on three real scenarios. If you’d like help with the policy, the tool choices or a privacy and security review of the AI you already run, see our AI and agents work or get in touch.