Once people at work start using AI tools, they need simple answers: which tools are allowed, what can go into them, who checks the result, and what to do when something goes wrong. A short written AI use policy gives those answers in one place. This page explains what such a policy usually covers and gives a sample outline to adapt.
This is a general planning guide, not legal advice. What your policy must include depends on your country, sector and contracts; check with a qualified adviser.
The short answer: a good employee AI policy is short and practical. It lists approved tools, sets clear data rules, says what output must be checked and by whom, sets limits for AI agents that can take actions, explains how people are told when AI is involved, and names who to ask and how to report problems. It is reviewed regularly as tools change.
Why write one
Without a policy, people either avoid useful tools or use them in ways nobody has checked. The NIST AI Risk Management Framework lists, under governing AI, that the risk management process and its outcomes are established through transparent policies, procedures and other controls, and that roles and responsibilities and the frequency of periodic review are clearly defined (NIST AI RMF 1.0, GOVERN 1.4 and 1.5). A policy is also the backbone of training; see how to train employees on AI.
What the policy should cover
- Scope: who it applies to (staff, contractors) and which kinds of AI (chat tools, assistants built into software, AI agents).
- Approved tools: a list, and how to request a new one.
- Data rules: what must never be entered (for example, customer personal data, confidential plans, passwords), and what may go into which tool. See AI agents and personal data.
- Checking and ownership: the person who sends, signs or approves is responsible for the result, however it was drafted. AI can produce confident but wrong output, which NIST calls confabulation (NIST AI 600-1). See checking AI output.
- AI agents: who may set one up, what access it gets, and which actions need human approval. OWASP recommends limiting AI tools to the minimum permissions needed and requiring a human to approve high-impact actions (OWASP LLM06:2025). See AI agent security.
- Uses that are off limits or need extra review: for example decisions about hiring, pay or performance, and anything your sector restricts. See AI at work and workers' rights.
- Transparency: when customers or colleagues should be told AI was used.
- Intellectual property: how to treat AI-generated material. See AI-generated work and copyright. If staff are covered by a union contract, check what it says about AI; see AI and unions.
- Training: what training people need before using which tools. If you operate in the EU, see AI literacy at work.
- Reporting problems: how to report a mistake, a data leak or an agent doing something unexpected, without blame for honest reports.
- Ownership and review: who owns the policy and how often it is reviewed.
Sample outline
Adapt the wording, length and detail to your organization. Square brackets mark what you fill in.
- Purpose. This policy explains how [organization] staff may use AI tools at work safely and responsibly.
- Who it applies to. All employees and contractors using AI tools for [organization] work.
- Approved tools. You may use the tools listed in [location]. To request a new tool, contact [team].
- Never enter. [List: e.g., customer personal data, health data, passwords and keys, unreleased financial results, confidential client documents].
- Check before you use. You are responsible for anything you send, publish or decide using AI output. Check facts, figures, sources and tone first.
- Extra review needed for. [List: e.g., anything sent to customers in bulk, legal or contractual text, decisions about people].
- AI agents. Only [role] may set up an agent. Each agent has a named owner, the minimum access it needs, logs, and human approval for [list of high-impact actions].
- Telling people. Tell [customers / colleagues] when [circumstances].
- Not allowed. [List of prohibited uses].
- Training. Complete [training] before using [tools].
- Problems and questions. Report mistakes, data incidents or unexpected agent actions to [contact]. Ask [contact] if unsure.
- Review. [Owner] reviews this policy every [period] and when tools change.
Making it work in practice
Keep it to a page or two; nobody follows a policy they cannot remember. Write it with the people who will use it, because they know where the risky tasks are. Back it with a short training session and an easy way to ask questions, and update it when tools change rather than once a year. For rolling out agents in particular, see introducing AI agents at work and human in the loop and accountability.
Questions and answers
What should an AI policy for employees include?
Scope, approved tools, data rules, who checks output and owns the result, limits and approvals for AI agents, uses that are off limits, when to tell people AI was used, training, how to report problems, and who reviews the policy.
Is there a sample AI policy for employees?
This page gives a plain sample outline with placeholders to adapt. It is a planning guide, not legal advice.
How long should a workplace AI policy be?
Short enough to remember, usually a page or two, backed by training and an easy way to ask questions.
Should an AI policy cover AI agents?
Yes. Agents can take actions, so the policy should say who may set them up, what access they get, and which actions need human approval.
How often should an AI policy be updated?
Whenever tools or uses change, and on a set review cycle. The NIST AI RMF calls for defining the frequency of periodic review.