AI acceptable use: five rules on one page
Clear operating boundaries for the people already using AI at work, and a route for exceptions.
Twenty minutes to a board deadline
A hypothetical example. A finance analyst has a draft board paper due in twenty minutes. The wording needs work. The analyst pastes it into a free chatbot. The result is better. It goes out on time. Nothing malicious happened.
But unreleased financial results now sit with a service whose terms nobody in your organisation has read.
Most people using AI at work are trying to do their job better. They need to know where the lines are. A blanket ban can push use onto personal devices where you cannot see it. A long policy is rarely read in the moment that matters.
1 · Use the approved tools
Approved means approved for a specific purpose and a specific kind of data.
If what someone needs is not on the list, they ask. Name who decides and how fast. Without an exception route, people route around the rules.
2 · The stranger test
Never paste into an unapproved tool anything you would not email to a stranger: customer data, personal data, passwords and keys, unreleased financial results, source code.
Approved tools come with their own rules for which data they may hold. Follow those. Ask if you are not sure.
3 · You own what it produces
AI output is a draft. Check it before you send it, sign it or ship it. It can sound confident and still be wrong.
4 · Ask before you connect it to anything
This is the rule most acceptable use policies miss. Mailbox, drive, calendar. Depending on what is approved, a connected tool may read everything there. Read-only access still exposes that data, and some tools can also act on your behalf.
Your mailbox holds email written by strangers. An instruction hidden in one can be picked up by a connected assistant. You never opened it.
5 · Tell us what you use
Give people one simple way to declare tools. A form or a mailbox is enough.
If your policy authorises it, promise that declaring a tool in good faith will not be punished. Agree that promise with HR and legal first.
How to measure it
- Count declarations as an early signal. On their own they do not show that risk is falling.
- Track what you fixed: how many risky uses are still open, and how fast they close.
- If declarations stay flat, find out why. It may be low use, a channel nobody has seen, or a lack of trust.
AI literacy
In the European Union, providers and deployers must take measures to support AI literacy among their staff. Five clear rules are a start on that. They are not the whole duty. Role-based training still matters.
What I would do on Monday
- Publish the five rules on one page. Keep it short enough to read in a minute.
- Name the approved tools and what each is approved for.
- Name who decides exceptions, and how fast.
- Open a declaration channel and agree the good-faith commitment with HR and legal.
Your people will use AI either way. Clear lines and a route for exceptions make telling you the easy path.
Sources
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Article 1(5), replacing Article 4 of Regulation (EU) 2024/1689 — providers and deployers "shall take measures to support the development of AI literacy of their staff"; the obligation does not require any specific level of literacy for any individual. Applicable from 27 July 2026. EUR-Lex
The finance analyst is hypothetical. Statements about bans and long policies are professional judgement. These rules support AI literacy; they are not complete compliance.