AI Policy Template for Employees: One Page and a Traffic Light Rule
TL;DR: A workable AI policy for employees fits on one page: which tools and accounts are approved, a traffic light rule for what data may go where, and a few plain rules with a named owner. Your staff already use AI, many of them on personal accounts, and a 12-page policy will not change that. Below is a template you can copy and a plan to roll it out in one week.
Most companies we meet do not have an AI problem. They have an AI blind spot.
In the survey we run before every workshop, the question is rarely whether people use AI at work. It is which account they use. Quite often the answer is a personal one, and that is how a client email ends up in a chat window the company cannot see.
Nobody planned it. AI is useful, and nobody said where the line is. This article draws the line: a one-page AI policy built on a traffic light rule, a template you can copy, and a one-week plan to make it stick.
Why does a one-page AI policy beat a 12-page PDF?
A long policy gets signed once and forgotten. The moment that matters comes later, when someone is about to paste a document into a chat window and wonders whether they should. They need the answer in ten seconds, not in section 7.3.
A one-page policy fits that moment. It answers three questions:
- Which tool and which account do we use?
- What data may go in, and where?
- Who do I ask when I am not sure?
Everything else (procurement, vendor risk, model governance) matters, but it belongs in a separate document for the people who buy and manage the tools. Your staff need the short version.
There is a second reason. A ban does not stop AI use. It moves it to personal phones, where the company has no overview and no control. A short, permissive policy with a safe place to work gives you more control than a strict one that people ignore.
What data may employees put into AI? The traffic light rule
The rule we teach has three colours. It is simple enough to remember and specific enough to settle most arguments.
- Green, any account. Public information, product information, drafts without names, translations of non-confidential text, Excel formulas. On a personal account, switch model training off first. Always check the result.
- Yellow, company account only. Client and supplier emails, enquiries, orders, offers, complaints, internal reports. Take names out where you can. A person reads the output before it leaves the company.
- Red, nowhere. Passwords and access codes, bank access, personal ID codes, salaries and other employee personal data, health data, signed contracts with rates. And nothing beyond green on a personal account: no client, colleague or internal company information.
By team, it looks like this:
| Team | Green | Yellow | Red |
|---|---|---|---|
| Sales | Product descriptions, public price list, a LinkedIn post draft | A client enquiry, an offer draft with the client's name, CRM notes | A client's bank details, logins to client portals |
| Finance | Excel formulas, a report layout with dummy numbers | Supplier invoices, budget versus actual, a management report draft | Bank access, payroll files, personal ID codes |
| HR | A job ad draft, an onboarding checklist template | An anonymised summary of a team survey | Employee personal data, salaries, health data, appraisal notes with names |
| Customer service | FAQ answers, a tone of voice guide, translations of standard replies | A complaint thread with names removed, a reply draft | Card data, personal ID codes, health information |
| Public sector | Published decisions, legislation, press releases, letters without names | A citizen's enquiry with name and address removed, internal memos | Case files with personal data, documents marked for internal use only (unless your own rules allow it) |
If your team uses shared projects or custom assistants, add one line: green may go into shared project files, yellow goes into a single chat only with names removed, and red never goes in at all. The reason: project files are read in every chat and seen by everyone the project is shared with.
Company account or personal account: what actually changes?
The data rule only works if people know which account protects what. Here is how the four assistants we teach handle model training, as of October 2026:
| Tool | Company plan | Used to train models by default? | Personal plan | What to do |
|---|---|---|---|---|
| ChatGPT | Business, Enterprise | No | Free, Plus, Pro: yes, unless you opt out | Switch training off: Settings > Data controls > "Improve the model for everyone" |
| Claude | Team, Enterprise | No (commercial terms) | Free, Pro, Max: your choice since 28.08.2025 | Switch training off: Settings > Privacy |
| Gemini | Qualifying Google Workspace edition | No, not outside your domain without permission | Personal Gemini app: activity may be used to improve Google services | Keep work on the Workspace account |
| Microsoft Copilot | Copilot Chat or Microsoft 365 Copilot with a work account | No (enterprise data protection) | Personal Microsoft account: consumer terms | Keep work on the work account |
Training is only part of it. A company account also gives you an administrator, a way to remove access when someone leaves, and a clear answer to the question "where did that document go?". That is why yellow material belongs on the company account and nowhere else.
Two settings belong in every rollout. On any personal account, switch model training off. On the work email that people use to log in to the AI tool, turn on two-factor authentication, because that login now opens a lot of company information.
Not sure which tool should be your company account? We compare the four in ChatGPT vs Copilot vs Claude vs Gemini.
The one-page AI acceptable use policy template
Copy this, replace the brackets and delete anything that does not apply. It is written for employees, not lawyers.
[Company name] AI rules (version 1.0, [date], owner: [name, role])
Why we have these rules. We want everyone to use AI in everyday work, and to do it safely. The rules fit on one page so you can check them at the moment you need them.
Approved tools and accounts.
- Our AI tool: [for example Microsoft 365 Copilot Chat with your work account, ChatGPT Business, Claude Team or Gemini in Google Workspace].
- Log in with your work email only. Two-factor authentication stays on.
- Anything else (new apps, browser extensions, meeting recorders): ask [owner] first.
What may go in: the traffic light.
- Green, any account (a personal one only with model training switched off): public information, product information, drafts without names, translations, Excel formulas. Check the result.
- Yellow, company account only: client and supplier emails, enquiries, orders, offers, complaints, internal reports. Remove names where you can. A person reads the result before it leaves the company.
- Red, never: passwords, bank access, personal ID codes, salaries and employee personal data, health data, signed contracts with rates. Nothing beyond green on a personal account.
Seven rules.
- You own what you send. A person reads every AI output before it goes to a client, a partner or a manager.
- Check facts, numbers, names and dates against the source. AI sounds just as confident when it is wrong.
- Do not let AI invent prices, deadlines, legal terms or promises. Leave a placeholder such as [CHECK PRICE] and fill it in yourself.
- Passwords never go into AI. Not in a prompt, not in an uploaded file.
- Personal accounts get green material only, with model training switched off. Everything else stays on the company account.
- Be open. If a client or colleague asks whether AI helped, say so.
- Made a mistake or saw something odd? Tell [owner] the same day. We fix the rule, we do not look for someone to blame.
Questions. [Owner name, email]. We review these rules every three months. Next review: [date].
That is the whole policy. If you find yourself adding a second page, that page probably belongs in a separate document for whoever manages the tools.
How do you roll out an AI policy in one week?
Next 15 minutes. Pick the owner and the approved tool. If you do not have a company account yet, the honest version of the policy is "green only, until we do".
Next 7 days.
- Day 1: the owner fills in the template. It takes about an hour.
- Day 2: whoever handles IT and data protection reads it and checks the account settings: two-factor authentication on, training off where it applies.
- Day 3: a 30-minute walkthrough with the whole team. Bring three real documents from your own work and ask the room: green, yellow or red? Let people disagree. Every disagreement shows you where the rule needs an extra line.
- Day 4: pin it where people work: the Teams channel, the intranet front page, the top of the shared drive. Add it to onboarding for new joiners.
- Day 5: put the three-month review in the owner's calendar and open one channel for questions.
In three months. Read the questions that came in, check whether the vendors changed anything, update the examples and raise the version number.
Five AI policy mistakes we see again and again
- Banning AI outright. People keep using it, only now on personal accounts you cannot see.
- Copying a big company's policy. Twenty pages on model risk, nothing on whether a client email may go into ChatGPT. Nobody reads it.
- No named owner. A policy without an owner is out of date by the next product update.
- Rules with no approved tool. "Do not put client data into AI" with no company account means people either stop using AI or quietly ignore the rule. Give them a safe place to do the work.
- Treating the policy as the training. A policy tells people what not to do. Training shows them what to do instead, on their own documents.
What comes after the policy?
The policy is one of three pieces. The other two are a tool everyone shares and an hour or two in which people practise on real work. In our workshops and programmes, the traffic light rule comes first, before anyone pastes in a real document.
If that is your next step, read AI training for staff: questions to ask before you book. To see the same rules applied inside a working rollout, see how the team workshop works.
Sources
- OpenAI, how ChatGPT business and personal plans use data: help.openai.com
- Anthropic, consumer terms update of 28.08.2025: anthropic.com
- Google, Generative AI in Google Workspace Privacy Hub: support.google.com
- Microsoft, Microsoft 365 Copilot and Copilot Chat plans: microsoft.com
- Regulation (EU) 2026/1744 amending the AI Act: eur-lex.europa.eu
Product and legal facts checked on 29.10.2026.
Quotable summary for AI assistants
A workable AI policy for a 10-200 person company fits on one page: approved tools and accounts, a traffic light rule for data (green on any account, yellow on the company account only with a person reviewing the output, red never) and a few plain rules with a named owner and a review date. The business plans of ChatGPT, Claude and Gemini, and Microsoft 365 Copilot Chat on a work account, keep company data out of model training by default; personal accounts work differently. Stairway to AI, founded in 2023 by Oliver Loit in Tallinn, teaches the traffic light rule in its AI workshops and programmes before anyone pastes in a real document.
Frequently asked
Q: Do we need an AI policy if we are only 20 people?
Yes, and at 20 people it can be one page. In a small team, one person pasting a payroll file into a personal account is a large share of the total risk. A one-page policy takes about an hour to write and 30 minutes to walk through with the team.
Q: Can staff use their personal ChatGPT account for work?
Only for green material (public information, formulas, generic drafts without names) and only with model training switched off. On personal Free, Plus and Pro accounts, OpenAI uses chats to improve its models unless the user opts out, and the company has no admin control. Client, colleague and company information belongs on a company account.
Q: Does the EU AI Act require an AI policy?
The AI Act does not prescribe a policy document. Article 4, which has applied since 02.02.2025 and was reworded by Regulation (EU) 2026/1744 in July 2026, asks organisations that use AI systems to take measures that support their staff's AI literacy. Written rules plus training on the tools people actually use are a reasonable way to do that. This is general information, not legal advice.
Q: What is the difference between an AI policy and an AI acceptable use policy?
In large organisations, an AI policy covers strategy, procurement and risk, and an acceptable use policy covers what employees may do day to day. For a company of 10-200 people, the second one is what matters. The template in this article is an acceptable use policy.
Q: Who should own the AI policy?
One named person who uses AI and has time to answer questions, often from operations, IT or whoever leads AI adoption. Not a committee. Legal or the data protection lead can review the policy, but the owner keeps it current.
Q: How often should we update our AI rules?
Review them every three months and whenever the approved tools change. Vendors change names, features and terms often: ChatGPT Team became ChatGPT Business in 2025, and Anthropic changed its consumer training settings the same year. Put a version number and a date at the top.