Someone on your team is probably curious about AI. They may use it to draft an email, summarize notes, or brainstorm a presentation before the business has made any decision about which tools are appropriate. A blanket “don’t use AI” rule can leave staff guessing; an unrestricted “use whatever saves time” rule leaves the business guessing instead.
A useful policy answers everyday questions in plain English: Which tools are approved? What information can people enter? Who checks the result? And how does someone request a new tool? It also needs to cover the less obvious cases: meeting bots, AI-connected automations, voice impersonation, and what to do after a mistake.
NIST’s generative AI risk guidance addresses governance, privacy, information integrity, and human oversight. A detailed policy can cover all of those areas. The harder part is making its rules clear enough that someone will follow them during an ordinary workday.
Start with an approved-tools list
Name the specific business accounts or products employees may use, the approved purposes, and the person responsible for administering each one. “AI is allowed” is too vague: different tools and account plans may have different settings, integrations, and data-handling terms. An authorized-software appendix can be updated as tools change, while the main policy keeps the approval rule clear. Unless a tool is approved, staff should not use it for company work.
Before adding a tool, check who owns the account, who can see conversation history, what data the vendor retains or uses, what integrations it can access, and how an employee’s access is removed when they leave. Do not assume a paid account is automatically approved for every kind of customer data; verify its actual terms and configuration.
Draw a data boundary people can remember
Put information into a few practical categories:
- Public: Published information or fictional examples can be used with approved tools.
- Internal: Nonpublic business information needs review and appropriate anonymization before it goes into an approved tool.
- Restricted: Credentials, payment details, sensitive personal information, and confidential client information should not be entered into AI tools under the standard policy. If a business needs an exception, it should define and approve that workflow separately before any data is submitted.
The precise boundary should reflect your customer obligations and the tools you have approved. If employees cannot tell whether a prompt crosses it, give them one person to ask. “Remove the customer’s name” is not always enough when the remaining details still identify them.
Decide how meeting notes and connected apps work
An AI note-taker may record more than the person who installed it realizes. A sensible default is not to invite a meeting bot or install an AI browser extension until it has been approved. Decide who may enable recording, whether participants must be notified or consent, where recordings and transcripts go, who can access them, and how long they remain available. Have counsel or an appropriate advisor review legal or contractual requirements when needed; this article is not legal advice.
Treat AI connections to email, file storage, and business systems as a separate approval decision. A tool that only drafts text has a different risk profile from one that can read a shared drive or send messages on a user’s behalf.
Keep a person responsible for the result
AI can produce confident but incorrect text. Require a human to review factual claims, customer-facing promises, financial information, and any advice that affects security or operations before it goes out. Name the decision owner for higher-impact uses; an AI-generated recommendation does not authorize a change to someone’s account or systems.
Add a separate check for urgent financial requests, especially if a caller or message claims to be an executive. Verify through a known contact method rather than trusting the apparent voice, video, or sender. And make it easy to report a mistake: if sensitive information was entered into the wrong tool, employees should know whom to tell promptly, without trying to hide the incident or fix it silently.
Turn the written policy into everyday decisions
A quick-reference card alongside the full policy could begin with four sentences:
Use only the AI tools listed by the business for approved tasks. Do not enter restricted data into an AI tool under the standard policy. Check AI output before using it for business decisions or sending it to customers. Ask the designated owner before connecting an AI tool to company systems or trying a new one.
Those four sentences are a reminder, not the whole policy. A fuller acceptable-use policy should also address client contracts, regulated data, employee and contractor access, AI-assisted decisions, reporting, and how the approved-software list is maintained. Review it when tools, contracts, or business workflows change. Pair the rules with one real demonstration: show an acceptable prompt, a prompt that needs approval, and a situation where an employee should stop and ask.
If your Coastal Bend business is putting AI rules in writing, request Copano IT’s AI Acceptable Use Policy template as a starting point. Share your first name and email through the request form (company name is optional), and we’ll send you a copy. The template needs to be adapted to your tools, contracts, and legal requirements before your team adopts it. Copano IT can also help scope business AI setup and integrations against the systems and data you already use.
