PPROMPT WORKBOOK Build a prompt
From shadow AI to usable rules

AI use policy template for organisations

An AI use policy should help people use approved tools correctly. A broad ban without workable alternatives often pushes use out of sight.

Seven decisions the policy must make

  1. Purpose: which work AI should support.
  2. Tools: approved services, accounts and features.
  3. Data: what must never be shared and who can approve exceptions.
  4. Quality: what must be checked, tested or signed off by a person.
  5. Disclosure: when AI use or synthetic content must be identified.
  6. Accountability: who owns the output, vendor and risk.
  7. Incidents: how data exposure, errors and unexpected agent actions are reported and stopped.

Short template

# Purpose and scope
These rules cover generative AI use in [organisation].

# Approved tools
Use only [list/portal]. [Role] reviews new tools.

# Data
Do not share [personal data, confidential material, secrets, credentials].
Use [approved service] for [permitted internal data].

# Quality and accountability
AI outputs are drafts. The person using or publishing them verifies facts, sources, rights and fitness for purpose.

# Actions
AI may not send, publish, delete, purchase or change access without [defined approval].

# Disclosure
Disclose AI use when [criteria]. Apply specific rules to synthetic media.

# Incidents and help
Stop and report to [contact] after accidental disclosure, unexpected action or uncertainty.

# Review
Owner: [role]. Last reviewed: [date]. Next review: [date].

A policy is not training

Add short examples of allowed, questionable and prohibited use. Connect the policy to normal security, privacy, procurement and incident processes. Adapt the template to your legal and organisational context before use.

Sources