How to set up AI workplace policies

AI tools are now widely adopted in workplaces of all types, from food trucks to multi-location retail. AI is also making its way into software your business relies on, like CRM solutions and business phone service.

In fact, 88 percent of businesses are using AI in at least one part of their business according to McKinsey. Using AI effectively, however, is a different story, and it starts with getting your employees on the same page with strong AI policies.

Below, we’ll walk you through what you need to think of as you build your AI policies and how to effectively communicate them with your staff.

What is an AI workplace policy?

An AI workplace policy is a clear set of guidelines for how your business approaches AI. It communicates to your employees the following:

• What AI tools they can use
• What kind of data can be shared with AI
• How employees should verify or vet AI-generated content
• Procedures for using AI

Together, these things will keep your employees on the same page about how to use AI while being aware of industry regulations and compliance.

Why do you need AI policies?

When it comes to AI, the genie is out of the bottle. People are using AI, people are talking about AI, other businesses are using AI. Even if you don’t want to use AI yourself, you need a coherent policy that aligns your business and employees on what to do and how to do it.

Part of the reason is that, depending on your business, you could have employees using AI for their own purposes. Maybe they like to use AI even if your business has no official policy.

From hallucinations to leaked customer data or proprietary company information, using AI comes with risk. Any employee that uses AI for work exposes your business to these risks.

For example, over 60 percent of businesses are worried about what happens with customer and business data when they use AI tools, according to Ipsos.

That’s on top of the risk of hallucinations, which can vary in their severity. Giving your employees wrong information they then share with customers can degrade your business reputation, but there are other hallucination threats as well. Air Canada famously was held responsible after its AI chatbot hallucinated a discount that didn’t exist.

That’s why it’s important you outline how your business handles AI and what your employees need to know. But how do you actually write such a policy?

How to write an AI policy for your business

Like any good writing, the first step is always research and thinking through the possibilities. For an AI policy, that means thinking about your employees and their roles in your company.

Are your employees generalists or specialists?

What are your employees doing for their jobs? Are their roles specialized functions? For example, if you’re a dental office do you have a hygienist and front office staff? If so, your employees are specialists. If you’ve got a small retail business where everyone is an associate that swaps between stocking items, helping customers, making social content and working the checkout counter, they’re generalists.

This is important because it sets up how you use AI going forward. Generalists can have more freedom to use AI tools for a number of reasons as long as they serve the business, while specialists can concentrate on using it only for their job responsibilities.

A receptionist, for example, can use AI to manage call log data and produce a report about what days and times during the week you receive the most calls. While a generalist can use AI to help create images, manage data, and create an app that takes care of a niche need your business has.

Is your team already using AI?

Survey your employees and see whether they’re using AI and how they’re using it. They may have some good ideas you can incorporate into your official policy. Or, they could be using it in a way that wouldn’t reflect well on your business that you may not have thought of.

What you can and can’t use AI for

This is where you get very prescriptive and designate what employees can use AI for and what they can’t use AI for. You can, for example, tell employees they can’t generate images with AI.

Or, maybe you don’t want employees to rely too heavily on AI. Like a receptionist using AI-generated scripts for phone calls or a sales person creating content they share with customers.

You can also define what you want employees to use AI for and encourage them to explore it in certain ways. Maybe you run a restaurant, and you’d like employees to use AI to create ideas for content your business can make for Instagram or TikTok.

What data employees can input into AI

This is one of the most important sections of any AI communication document. You must be careful with what data you input into AI. There have been several AI data leaks affecting businesses, with the latest one being AI aggregator 302.ai in October 2026, which had 22.7 terabytes of data leaked.

The leaked data included user prompts, AI responses, metadata and sensitive corporate documents. A data leak with that much information can negatively affect your business in several ways, from a broken reputation and customer trust to massive financial consequences.

You should outline whether employees can input data like customer information, proprietary information and future plans into AI. For example, if you’re a lawyer you may not want to input case information into AI. If you’re a dentist or doctor, you’ll have to consider HIPAA and be very careful about how you handle patient medical information with AI.

AI-generated content review guidelines

Any AI client will tell you that AI can make mistakes, and you should take them at their word. Do not blindly trust anything that comes out of AI and shuffle it toward another employee or your customers. Sometimes AI automation can go too far, resulting in negative consequences like the Air Canada story.

You should codify this in your AI policies. Create a rubric for how employees should review work that comes from AI. For example, maybe you want them to fact-check and read over anything it generates.

A rubric for reviewing AI could include its very own set of guidelines. Maybe you want all content generated by AI to be accurate, easy-to-read and altered by a human. That could mean having a human take content from AI and rewriting or heavily editing it. Or maybe it’s simply double-checking AI’s work to make sure it all makes sense and actually works.

One thing to also keep in mind: According to the U.S. Copyright Office, AI-generated content without sufficient human authorship may not qualify for copyright protection. So, if you’re using it to create content for your business, like a logo or images, you’ll want to make sure human hands have edited it significantly.

This is also the best place to include any AI tips you have for your employees as they review content they’ve created.

Ethical guidelines

Your business should set a tone for AI in a general way too, and that means declaring what you think of AI in a document.

Maybe your business thinks AI is a powerful tool but shouldn’t replace human ingenuity. Or maybe you don’t want your business to use AI at all. You could even go the complete opposite way and fully embrace AI in all ways without restriction.

Whatever your thoughts on AI, whatever your thoughts on how AI use should represent your business, you should put it down in writing so your employees can march to the same beat.

If you don’t, there’s a chance AI use could become a debated topic within your company and a discussion you may have to have at some point anyway.

Responsibility and accountability

Finally, you need to outline who is responsible for AI use. Ask yourself the following questions:

• Is each employee responsible for what they input in AI?
• Are employees responsible for verifying AI content?
• Are AI companies at fault when AI chatbots hallucinate?

Make it clear what happens when boundaries are crossed or if unfortunate events like a data leak, wrong information or hallucinations affect your business and your relationship with your customers.

AI communications for the future

The world of AI is constantly changing. New models are on the horizon and we’re learning new things about how they work and how to use them daily, as well as their impact on businesses and customers.

Your AI policy is a living document that you’ll need to update as technology and society evolves. The most important part, however, is that you’ve already taken the first step with a workplace policy.