What rules should I give employees who use AI at work?

Give employees clear rules about approved tools, permitted information, review responsibilities, and actions that require approval. Include a named contact for questions and mistakes. Keep the first version short enough to use during ordinary work, then add detail for higher-risk processes such as customer communications and financial records.

The scope of the policy matters more as AI gains access to business systems. Microsoft's August 2026 account of implementing Agent 365 internally discusses visibility and management of agents across its organization. A smaller business needs a proportionate version of that visibility: knowing which assistants exist, what they can access, and who owns them.

What should the first policy cover?

Begin with the work people are already doing. Ask which tools they use to draft emails, summarize meetings, inspect spreadsheets, or answer questions. Explain that you need an inventory to make sensible decisions about access and support.

Then write rules for your actual situation:

Avoid a rule such as "use AI responsibly" without explaining what a staff member should do. A new employee should be able to apply the policy to an ordinary task.

What information should staff be allowed to enter?

Make the decision by information category and approved tool. Public website copy may need different controls from customer records, employee information, unpublished prices, or contracts.

Have the person responsible for data and contracts review the vendor's terms, retention settings, administrative controls, and intended use. A paid account alone does not establish that every category of business information is suitable for it. Record the decision so staff do not have to interpret terms themselves.

When a task can be tested with fictional or anonymized examples, start there. Keep credentials and secrets out of prompts. If an assistant needs system access, arrange a supported connection with limited permissions instead of pasting a shared password into a conversation.

Who checks the work?

Name the role that owns each output. A salesperson checks a draft quote against the approved rates. A manager checks a performance summary against the source records. Give the person approving the work access to the evidence behind the answer.

For financial, legal, employment, or other specialist decisions, retain the review process appropriate to that work. An assistant's confident explanation cannot replace the responsible person's assessment.

If an AI tool can change records, enforce approval in the workflow where possible. An instruction to "ask before sending" is weaker than an integration that cannot send until an authorized person approves.

What changes when staff connect an AI agent?

A connected agent needs an owner, a purpose, and a list of permissions. Record which systems it can read and which actions it can perform. Decide how to pause it and who receives failure notifications.

Review access when someone leaves, changes role, or stops using a tool. Include scheduled tasks and shared integrations in that review; cancelling a person's seat may leave another connection active.

Our AI governance service can help map these responsibilities to the tools your team actually uses. For a wider inventory discussion, see shadow agents in the workplace.

How do we make the policy usable?

Walk staff through a few real examples: drafting a public social post, summarizing a customer complaint, preparing a quote, and connecting a mailbox. Show the approved path for each and the point where they should ask for help.

Make reporting mistakes straightforward. Staff should know whom to contact if an assistant sends the wrong message, accesses an unexpected file, or produces an inaccurate customer answer. Preserve the relevant records and follow your existing incident process. Update the policy when the incident reveals an unclear rule.

Frequently asked questions

Should I ban all personal AI accounts at work?

Decide which accounts are acceptable for business tasks and explain the approved alternative. A restriction is more workable when staff can still complete their work through a supported tool.

Does a small company need a formal AI committee?

It may be enough to name an accountable owner and involve the right people for data, technical, and commercial decisions. The responsibilities need to be clear even if the team is small.

How often should we review the rules?

Review them when tools, integrations, or use cases change, and after a significant incident. Set a regular review date so an unused document does not become the only record of your controls.