An AI usage policy need not be a lengthy document nobody opens. For a small team, its value is helping employees quickly decide what material they may supply, who checks outputs and which tasks must not be delegated to the tool.
Start with current uses: email drafts, meeting summaries, file analysis, images, code or customer service. The policy should govern these workflows and evolve with practice.
Divide uses into three zones
Permitted: low-risk work using public or approved material with mandatory human review. Approval required: work involving company data, external communication or consequential decisions requiring a named owner. Prohibited: unapproved sensitive inputs, automatic company commitments or decisions affecting people without appropriate oversight.
Place real business examples beside each zone. General terms invite inconsistent interpretations.
Specify which data may be used
Create simple categories: public, internal, confidential and information about people or customers. For each, specify permitted approved tools and purposes. If a tool's input retention or usage is unknown, do not send material until the assessment is complete.
Make human review specific
“Always review” is insufficient. For text, check facts, names, numbers, permissions and tone. For code, check functionality, security, dependencies and tests. For images, check whether real people, events or products are misrepresented. The owner must be able to explain and support the final result.
Plan failure reporting
Explain what employees should do when AI produces inaccurate, offensive or prohibited results, or when inappropriate data were sent accidentally. Define a simple reporting channel, incident reviewer and initial containment steps. Reporting should support learning rather than punish early recognition of a problem.
Maintain an approved-tool register
For each tool, record ownership, purpose, company account, permissions, review date and exit process. Remove unused tools and access for people whose roles changed. Critical operations should not depend on personal accounts or configurations known only to one colleague.
Review actual incidents
Monthly or quarterly, examine a sample of usage and team questions. Add examples addressing confusion, remove unenforced rules and reassess new features. A useful policy is short, visible and connected to everyday work.
This three-zone framework and review structure are DigitalNow's original methodology and require adaptation to each organisation's obligations.