Developing an AI Use Policy: 6 Considerations for Employers

Generative artificial intelligence (AI), which creates text, images, code, and other content in response to user prompts, is increasingly becoming integrated into everyday work. Tools such as ChatGPT, Microsoft Copilot, and Google Gemini are publicly available online, meaning, employees may be accessing them independently of any employer-sponsored AI initiative.    

Without clear guidance, employees may be left to make their own decisions about which generative AI tools to use, what information to share, and whether to rely on the results. At a foundational level, developing an AI use policy gives employers an opportunity to set clear expectations for how employees may use generative AI in their work and the safeguards they must follow.  

But what makes an AI use policy effective? The following considerations can help employers develop a policy that reflects their organization’s needs, provides practical guidance for employees, and addresses the risks associated with workplace AI use.  

1. Evaluate Where AI Can Support Work  

Before drafting a policy, employers should consider how generative AI may support their organization’s work and business goals. Certain AI tools can assist with activities such as brainstorming, drafting communications, or organizing information, although their usefulness will depend on the task, the information involved, and the level of review needed.  

Input from Human Resources, IT, legal counsel, and other department leaders can help identify where AI could be useful and assess the associated risks. While existing employee practices may reveal potential opportunities for AI use, it should not exclusively determine what the organization permits. Instead, the policy should reflect where AI can appropriately support the business and establish limits where its use is unsuitable.  

2. Decide Which Tools Are Appropriate  

Beyond acceptable uses, the policy should identify which tools have been approved for employee use, as well as any access requirements, such as company-provided accounts or credentials. Familiarity with a product’s name, or the availability of a free account, should not substitute for that review.  

In evaluating approved tools, employers should consider a tool’s privacy terms, security controls, data retention practices, and the treatment of submitted information. Protections may differ across vendors, products, subscription levels, and account settings, so employers should establish a clear process for asking questions of a vendor or requesting review of a proposed tool.  

An organization also may approve different AI tools for different purposes. The policy should clarify which tools employees may use for particular tasks, rather than treating the approval of a particular tool as permission to use it for any work-related activity.  

3. Clarify What Information Employees May Share  

A general instruction for employees to “protect confidential information” may leave too much room for interpretation. Therefore, an effective AI use policy should communicate specific information-sharing restrictions in terms that employees can apply to their responsibilities. Examples of information that warrant explicit instruction may include, but are not limited to, personnel records, client information, and proprietary business materials.  

These considerations extend beyond user-generated prompts. Company information can be shared through uploaded documents, connected systems, and recording or transcription options. The policy should clearly identify what information employees may and may not share, regardless of how the tool receives it.  

4. Keep the Human in the Loop   

Human review and accountability are arguably the most important elements of an AI use policy and an employer’s broader approach to AI overall. Employees must understand that using these tools does not transfer responsibility for their work or replace their professional judgment. 

AI-generated material can sound credible while still containing errors. Responses may include invented facts or citations, sometimes called “hallucinations,” or reflect incomplete, outdated, or biased information. These limitations make meaningful human review essential, even when the output appears polished. 

An effective AI use policy should require employees to verify AI-generated content using reliable, independent resources before relying on it or sharing it. But review alone is not enough. The policy should also explain how employees should address errors, inaccuracies, bias, or other concerns they identify, including when and to whom concerns should be escalated so that appropriate corrective action can be taken.  

5. Integrate With Existing Workplace Expectations 

AI use intersects with obligations employers already address through confidentiality, information security, acceptable technology use, anti-harassment, and records retention policies (to name a few). An AI use policy should explain how those expectations apply to this technology without creating conflicting instructions. 

Employers should also consider how they will communicate monitoring practices, address violations, and receive reports of inappropriate use or accidental disclosures. Employees should have a designated contact for questions and a reporting process that protects those who raise good-faith concerns from retaliation.  

6. Thinking Beyond the Policy  

A written policy is more useful when employees understand how to apply it. Employers addressing AI use in the workplace should consider practical training to help employees recognize permitted uses, protect restricted information, and understand when to seek guidance.  

Employers should also consider how they will support employees after the policy is introduced. Designating individuals or teams to answer questions, communicate changes to approved tools, and keep the policy current can help maintain clear and consistent expectations. 

Developing a policy that works in practice requires attention to both its content and implementation. For assistance tailoring that approach to your organization’s needs, connect with a OneDigital HR expert for further guidance.