AI adoption often starts before the company has decided what responsible use looks like. Someone drafts an email. Someone uploads a document. Someone uses AI to analyze a problem. You do not need a 30-page policy to establish the first boundaries, but you do need clear operating rules.

Before you start

Identify who should review the draft internally, typically leadership plus the owners of HR, IT/security, legal/compliance, or other affected functions as appropriate.
Do not treat an AI-generated guide as legal, regulatory, privacy, or cybersecurity advice.
Keep the first version short enough that employees will actually use it.

The exercise

Decide what AI is encouraged to help with

Name ordinary, low-risk uses where responsible AI use is expected rather than discouraged.

Decide what information stays out

Define categories of confidential, regulated, personal, contractual, or proprietary information that should not be entered into unapproved systems.

Draw the human decision line

Clarify where AI may assist but a person must retain final authority.

Match verification to consequence

Low-consequence work may need ordinary review. Higher-consequence work needs stronger checking, source confirmation, or subject-matter review.

Assign ownership

Someone needs responsibility for updating the rules as tools, use cases, and company requirements change.

Keep it usable

The first version should be a practical one-page operating guide, not a comprehensive governance architecture.

Copy this prompt

Paste this into your AI tool

Copy prompt

Help me draft a practical one-page AI Use Guide for my company. This is an operating guide, not a legal policy.

Company type: [DESCRIBE COMPANY]
Industry: [INDUSTRY]
Approximate size: [EMPLOYEES]
Current AI use: [BRIEF DESCRIPTION]

Organize the guide around four decisions:
1. Appropriate everyday uses of AI
2. Information that should not be entered into unapproved AI systems
3. Decisions where a human must retain final authority
4. Work that requires verification before use

Use plain language employees and managers can follow. Keep it concise.

Flag areas that should be reviewed by HR, legal, cybersecurity, compliance, finance, or another specialist before adoption. Do not present the draft as legal or regulatory advice.

Review your result

Is anything too restrictive to follow in real work?
Is anything too loose?
Have you clearly identified information boundaries?
Who owns high-consequence decisions?
What must be independently verified?
Who will update the guide?

Operator example

LBM example

AI may be encouraged for meeting preparation, public research, and drafting. Uploading a customer-specific price file to an unapproved consumer tool may be prohibited. AI may help analyze a personnel issue, but the manager and HR retain the decision. A takeoff or quote that affects a customer commitment requires human verification.

What not to do

Do not publish an AI-generated governance draft without the appropriate internal review. Industry, contractual, privacy, security, employment, and regulatory requirements vary.

Save the result

Publish the approved one-page version where employees can easily find it. Add an owner and review date.

Next resource

Run an AI Checkup

Rules only work if you periodically check whether the AI use and context still match them.

Go to Run an AI Checkup

Working on this with a team?

The toolkit is built for individual use. Moving a whole team or company is a different level of work, and it is where most AI efforts stall.

See LBM AI Training

See how the full path works