One-page AI rules for a small team

Why bother with rules

Surveys now find that most people use AI at work, and that only about a third were trained by their employer. When there are no rules, careful people don't dare use it and careless people paste in anything. One page fixes both.

You don't need a lawyer or a consultant to start. You need five decisions written down where everyone can see them. Copy the page below, fill in the [brackets], and change anything that doesn't fit how you work.

The page to copy

How we use AI at [business name]

1. Tools we use. We use [tool, e.g. Microsoft Copilot with our work accounts] for work. Please don't use other AI tools for work without asking [name] first.
2. What never goes in. Passwords, bank or card details, customers' personal details, staff records, anything a client has asked us to keep private, and anything that isn't public yet.
3. Make it safe first. If you want help with something real, swap names for "Customer A" and exact figures for round numbers before you paste. If someone could still be recognised from the details, leave it out.
4. You check it, you own it. AI gets things wrong and says them confidently. Read every answer before it leaves the building. Check facts, figures, names and dates against the real source. If you send it, it's yours.
5. Say when it matters. Tell a customer or colleague you used AI if they ask, or if they'd be surprised to find out later.
6. If something goes wrong. Pasted something you shouldn't have? Tell [name] the same day. Nobody gets in trouble for owning up quickly.
7. Good uses. First drafts of emails and posts, summaries of long documents that aren't confidential, ideas, checklists, spreadsheet formulas, and explaining things in plain English.
8. We look at this again on [date, three months from now].

Agree it in fifteen minutes

1. Send the page round the day before, so nobody is surprised.
2. In the meeting, ask one question: "What do you already use AI for?" Listen first. You will learn something.
3. Read the eight rules aloud and ask what's missing or unclear for your work.
4. Change the page there and then. Rules people helped write are rules people keep.
5. Pin it where the team will see it, and put the review date in the calendar.

Five decisions only you can make

• Which tool? If you already pay for Microsoft 365 or Google Workspace, check what AI comes with your work accounts before buying anything else.
• Free or paid? Paid work plans usually promise not to train on what you type. Free personal accounts often do unless you change a setting.
• Who is the person to ask? One named person. It doesn't have to be the boss.
• What do your clients expect? Search your contracts for the words "AI", "confidential" and "third party".
• What will you never use it for? You may want to rule out hiring decisions, legal advice and anything about one named person.

Here is a one-page set of AI rules for a small team: [paste the eight rules]. Rewrite it for a [type of business] with [number] staff. We mostly use AI for [tasks]. We handle [kinds of information, described in general terms]. Keep it to one page, plain English, friendly but clear. Keep all eight points.

Write five short "Is this OK?" questions to test whether my team understands our AI rules. Use everyday situations from a [type of business]. Give the answer and a one-line reason after each. Our rules are: [paste the rules].

Read more from the people who set the rules

• The UK's National Cyber Security Centre on ChatGPT and large language models: what's the risk?
• The Information Commissioner's Office on AI and data protection
• Our checklist: What never to paste into AI