- Audience
- Company or nonprofit
- Scope
- organization
- Owner
- To be designated
- Status
- Draft
- Version
- 0.1
- Effective date
- To be confirmed
- Review date
- To be scheduled
Summary
- Company or nonprofit policy. Status: Draft. Version: 0.1.
- Activity permissions: Allowed: 2; Allowed with conditions: 4; Approval required: 3; Prohibited: 0.
- This draft approves no tools. Designate approved tools before use.
- Secrets are never permitted in general-purpose AI tools; sensitive data requires exact data-type, tool, and use approval.
- Consequential decisions require accountable human review and separate authorization.
1. Document control and scope
This policy applies across Example Organization to people and work covered by its authority. Owner: designated policy owner. Status: Draft. Version: 0.1. Region, if supplied, is review context only and does not establish local legal compliance.
2. Purpose and approach
This policy sets the rules for AI use and assigns accountability. Use is permission-based. AI may be used only for activities permitted in the activity matrix and subject to every listed condition.
3. Definitions
“AI tool” means software that generates, transforms, ranks, or analyzes content using an AI model. Assistive editing improves presentation without replacing professional judgment. Substantive generation creates or materially rewrites analysis, code, recommendations, or communications. “Approved tool” means a tool designated for a particular use and data type through the applicable approval process; familiarity or public availability is not approval.
4. Roles and responsibilities
The designated policy owner maintains this policy and coordinates its review. the designated approver decides requests to approve tools, exceptions, and uses within their authority. the person responsible for the work checks outputs before anyone relies on or releases them. Workers use approved tools and protect organizational and third-party information. Managers do not delegate employment or other consequential judgment to an AI system.
5. Approved tools and approval process
No tools are currently designated as approved. Before use, the designated approver must approve the tool, intended activity, account or deployment, and data types involved. Public availability or prior use does not constitute approval.
6. Permitted-use matrix
The activity matrix is part of this policy. For each activity, its permission, conditions, and clarification apply. All listed conditions must be met.
| Activity | Permission | Conditions and clarification |
|---|---|---|
| Brainstorming | Allowed | No activity-specific conditions. The policy's data and human-review safeguards still apply. |
| Internal drafts | Allowed | No activity-specific conditions. The policy's data and human-review safeguards still apply. |
| Customer communications | Approval required |
|
| Coding | Allowed with conditions |
|
| Research | Allowed with conditions |
|
| Data analysis | Allowed with conditions |
|
| Meeting notes | Allowed with conditions |
|
| Publishing | Approval required |
|
| Consequential decisions about people | Approval required |
|
7. Prohibited uses
The matrix contains no activity marked prohibited, but all stated boundaries still apply. Do not use AI to fabricate evidence, impersonate a person, evade security controls, violate rights, or make an unauthorized consequential decision. Do not use AI where law, contract, professional duty, or a controlling organizational rule prohibits it.
8. Data, privacy, confidentiality, and intellectual property
The only data categories selected for possible use are: public. Selecting a category does not by itself permit its use. Data may be entered only when the specific tool and proposed use are approved for that data type. Do not enter confidential information, personal data, student data, customer data, or other sensitive data unless the tool and proposed use have been expressly approved for that exact data type. Credentials, passwords, access tokens, private keys, authentication codes, and other secrets must never be entered into general-purpose AI tools. Inputs and outputs remain subject to access, retention, intellectual-property, contractual, and confidentiality requirements. If unsure, stop and ask the policy owner.
9. Output verification and human accountability
A person remains accountable for AI-assisted work. Before using or releasing it, check factual accuracy, calculations, citations, originality, bias, security, rights, and suitability for the intended audience. AI output is neither an authority nor a verified source. A matrix prohibition cannot be overridden. Where the matrix permits consideration of a consequential decision about employment, access, eligibility, safety, rights, or services, accountable human review and a separate authorization process are still required. Matrix approval alone does not supply that authorization.
10. Disclosure and attribution
Disclose AI assistance in external, published, customer-facing, or assessed work. A declaration must accurately describe the use. The following example is not a declaration on the user's behalf. A suitable disclosure identifies the tool, the task it performed, material changes made by a person, and the person who verified the result.
11. Workplace rules
AI use for source code, confidential work, customer communications, or published material remains subject to security, intellectual-property, contractual, quality, and release controls. A designated owner must review tools and material changes. Employment and other consequential decisions about people require separate authorization, meaningful human judgment, an opportunity to correct relevant information where applicable, and the records required by the authorized process.
12. Review, reporting, and exceptions
Report concerns to the designated policy owner through the usual organizational channel. Report suspected data exposure, unsafe output, rights concerns, or material misuse promptly. The reviewer must preserve relevant information, hear affected people where appropriate, and follow the organization's authorized investigation and corrective-action process. Exceptions must be written, limited in scope and duration, approved by the designated approver, and retained by the policy owner.
13. Training, communication, and acknowledgment
Before covered users begin AI use, the policy owner will provide onboarding on the matrix, approved tools, data limits, disclosure, verification, and reporting. Covered users will be asked to acknowledge that they received and understood the policy; acknowledgment does not waive rights or replace training.
14. Review and version history
The policy owner will review this policy annually and after a material incident, tool change, or change in applicable obligations. Changes require the designated approval process and notice to affected people. Confirm the effective date before adoption. Schedule the next review date. Version history: Version 0.1 | Status: Draft | Change: Initial draft.
Decisions to confirm
- Name the policy owner.
- Name the role or person authorized to approve tools and exceptions.
- Designate tools, deployments, intended uses, and approved data types.
- Set an effective date before adoption.
- Schedule the next review date.
Implementation checklist
- ☐ Confirm and name the policy owner.
- ☐ Review the sensitive-data rules for each proposed data type and use.
- ☐ Designate approved tools before permitting AI use.
- ☐ Resolve 5 open decisions before adoption.
- ☐ Complete the authorized approval process; this document remains Draft.
- ☐ Communicate the matrix, safeguards, disclosure rules, and reporting route.
- ☐ Schedule the annually review.
Acknowledgment
I received the Example Organization Workplace AI Use Policy and had an opportunity to ask questions. I understand where to find the current activity matrix and how to report concerns. This acknowledgment does not replace training or waive any rights. Name: ____________________ Signature: ____________________ Date: ____________________
This policy draft is not legal advice. Have the appropriate people review it before adoption.