AI Policy for Work: A Practical Template

An AI policy tells people which AI tools they may use for work, what information they may share, which outputs need review, and who owns each decision. A useful policy gives someone a clear next step when they face a real choice, such as uploading a client document or sending an AI-drafted reply.

The template below is a starting point for a workplace policy. fenbs can keep the rules people agree in Decisions and rules so connected assistants read them before working, alongside the tasks and questions needed to put them into practice.

What should you decide before adopting the template?

Name the policy owner, approver, reporting contact, and review date. Then identify the work the policy covers: employee use, contractor use, customer-facing systems, or a defined subset. An approved tool name alone is too vague; approval should identify the account, use, information, and available actions.

The NIST AI RMF Playbook↗ (opens in a new tab) provides voluntary suggestions for turning AI risk management into practical activities. Use it as a reference when assigning responsibilities, while having the appropriate people review obligations specific to your business and profession.

Replace the role labels in the template with actual owners and a working contact route before publishing. This page addresses workplace use; AI for policy writing covers using an assistant during drafting. Our AI governance library covers the surrounding practices.

What can you copy into your workplace AI policy?

Copy the clauses below into your policy home and adapt them to your approved uses. The words “policy owner,” “approver,” and “reporting contact” refer to the people named in your published policy. A proposal becomes a workplace rule only after your responsible person accepts it.

Purpose, scope, and responsibility

• Purpose: We use AI to support useful work while protecting information and maintaining human responsibility for results. AI output is working material until the required person has checked and accepted it.
• Scope: This policy applies to work performed for our organization with AI tools, including personal accounts used for that work. Existing security, confidentiality, contract, and professional requirements continue to apply.
• Ownership: The policy owner maintains these rules and answers interpretation questions. Each approved use has a named human owner who can pause it. Managers provide a contact route when that owner is unavailable.
• Uncertainty: If a use is outside an existing approval or the rules are unclear, stop that part of the work and ask the policy owner. A confident AI answer does not grant permission or resolve an approval question.

Approved tools, information, and connections

• Approved use: Use only the tools, accounts, and purposes listed in our current approval record. The record must identify the human owner, allowed information, allowed actions, required review, and any conditions or expiry.
• Information sharing: Share only information necessary for the approved task and authorized for that tool and account. Do not enter passwords, secret keys, or restricted information without the specific authorization and controls required by our existing policies.
• Sensitive material: Ask the responsible information owner before using client, customer, employee, or other confidential material. Removing a name alone may not make a document suitable for sharing. Prefer an approved nonsensitive summary when it meets the need.
• Connections: Obtain approval before connecting an assistant to a work system or expanding its access. Give it only the access needed for the approved use. A written instruction does not replace permissions enforced by the connected system.

Review, actions, and reporting

• Output review: The person using AI remains responsible for checking facts, source references, calculations, and suitability before relying on the result. Review must use the underlying source or evidence when the task requires verification.
• Consequential work: Obtain the required human approval before AI-assisted work creates a commitment, affects an individual’s opportunities, changes a live system, or leaves the organization. Identify the approver and the check required for each approved use.
• Action limits: An assistant may not send, publish, purchase, delete, or change an outside system beyond its approved authority. Proposals and drafts must remain distinguishable from accepted decisions. People retain responsibility for approvals.
• Problem reporting: Pause the affected activity and contact the reporting contact after suspected information exposure, unauthorized action, or harmful output. Preserve relevant evidence in the approved location without spreading sensitive material into extra chats or shared notes.
• Changes and exceptions: The approver records exceptions with their scope, reason, conditions, and end or review date. A one-time exception does not change the standing policy. The policy owner records accepted revisions and communicates what they replace.

How do you adapt the policy to your team?

Use concrete examples from your work to test the clauses. For a design studio, distinguish brainstorming with public material from uploading a client’s unpublished plans. For a software team, distinguish a suggested code change from permission to alter a live service.

Check the provider’s terms and account settings before approving information sharing. The NIST Privacy Framework↗ (opens in a new tab) offers a voluntary way to consider privacy risk. Your policy should name who checks the actual arrangement rather than assume all accounts from one provider handle information the same way.

Keep the approved-use record short enough to consult. If a colleague cannot tell whether their next task is allowed, add the missing example or boundary. The practical guide to using AI at work helps identify everyday activities worth including.

How do written rules become everyday behavior?

Explain the policy through decisions people actually make. Ask a teammate to find the approver for an unfamiliar tool, recognize an information-sharing limit, and report a mistaken output. These checks reveal unclear wording more usefully than asking whether everyone has read the document.

Give assistants the relevant instructions too, while keeping technical permissions in the systems that enforce them. A shared AI brain can carry the current rules between conversations. It should identify unanswered questions so an assistant does not treat a draft policy as settled.

In fenbs Decisions and rules, record what the responsible person approved and which instructions continue to apply. That gives the next assistant a usable starting point without making it the policy decision maker.

When should you revise the policy?

Review after a new tool, changed information use, new connection, incident, or repeated misunderstanding, as well as on the scheduled date. Record what changed and tell people which earlier instruction it replaces. An exception that keeps recurring deserves a deliberate review rather than quiet expansion.

How to do this with fenbs

1. Create a free account and add a project for your team’s AI use policy.
2. Add the policy owner and current approval details to the project context. Keep restricted legal or security documents in their approved locations.
3. Have a person accept the adapted rules, then record those choices in Decisions and rules. Keep draft changes and requests for exceptions open until someone decides.
4. Add tasks for testing the reporting route, checking approved accounts, and explaining the rules to teammates. Ask connected assistants to read project context before working.

fenbs does not inspect tool settings or enforce information controls in other services. Use specialist controls where you need them. It fits the shared decisions and work record: start with your three most important accepted rules and the first unresolved approval question.