How to write a team AI policy people will actually follow
A team AI policy people follow fits on one page, sorts rules by data type, and makes the approved path easy. Here is a template and a one-week rollout.
A team AI policy people will actually follow fits on one page, sorts rules by type of data rather than by tool, and makes the approved way to use AI easier than the workaround. It should tell people what they can do, not only what they can't. Write it with the people who use AI most, then review it every quarter.
Why most AI policies get ignored
Many AI policies are written once, by legal or IT, and then forgotten. They fail for the same few reasons:
Too long. Ten pages of terms nobody reads before pasting a doc into a chat.
Banned by default. "Do not use AI tools without approval" with no fast way to get approval.
Organized by tool. A list of approved apps that is out of date the month after it is written.
No approved alternative. People are told what not to use, but the approved tool is worse or missing.
Silent on the useful stuff. Nothing about how to share good prompts or where to save AI-assisted decisions.
The result is predictable. Gartner found that 88% of employees with access to enterprise AI also use personal AI tools for work (reported by CloudNews). Gallup found that, as of May 2026, only 36% of employees in organizations integrating AI strongly agree their manager supports their team's use of AI (Gallup). People are using AI either way. A good policy brings that use into the open.
What a good team AI policy includes
Aim for six short sections.
Section | What it answers | Length |
|---|---|---|
Purpose | Why we use AI and what we want from it | 2 sentences |
Approved tools | Which tools are approved and how to request a new one | A short list and one link |
Data rules | What data can go into which tools | A four-row table |
Review rules | What needs a human check before it goes out | 3 to 5 bullets |
Sharing | Where to save good prompts, outputs and decisions | 2 to 3 bullets |
Owner and review date | Who to ask and when this gets updated | 1 line |
Write data rules by type, not by tool
Tools change every month. Data types don't. Sort your data into four classes and say where each can go.
Data class | Examples | Where it can go |
|---|---|---|
Public | Published blog posts, public docs, job ads | Any AI tool |
Internal | Plans, internal docs, meeting notes, non-sensitive metrics | Approved business tools only |
Confidential | Customer data, contracts, financials, personnel matters | Approved tools with business data terms, only when needed for the task |
Restricted | Passwords, API keys, health data, anything under legal hold | Never in an AI tool |
Explain why the business-tool line matters. Consumer and business plans often have different data terms. For example, Anthropic trains new models on data from Claude Free, Pro and Max accounts when the user's training setting is on, while its Team and Enterprise plans fall under commercial terms that this does not apply to (Anthropic). OpenAI says it does not train on ChatGPT Business or Enterprise data by default (OpenAI). Link to each vendor's current terms rather than copying them into your policy.
Make the approved path the easy one
A policy only works if following it is easier than ignoring it.
Approve at least one strong general tool
If the approved tool is worse than a personal account, people will use the personal account. Ask your heaviest AI users what they need before you choose.
Give the approved tool real context
Set up shared projects with your product docs, brand voice and key decisions. An approved tool that already knows your business is the best reason to use it.
Make requests fast
Add a simple form or channel for requesting a new tool. Commit to an answer within a week. Slow approvals create shadow AI. See shadow AI at work.
Know your admin settings
Business plans have controls worth checking. On Claude Team and Enterprise plans, for example, owners decide whether memory is available, and it stays off for each member until they turn it on (How Claude's memory works). Decide your defaults and write them down.
A one-page template
Copy this and fill in the brackets.
[Company] AI policy. Owner: [name]. Last reviewed: [date].
Why: We use AI to move faster and spend more time on work that needs judgment.
You are responsible for anything you send, ship or decide, AI-assisted or not.
Approved tools: [list]. Request a new tool in [channel]; we answer within 5 working days.
Data: Public: any tool. Internal: approved tools only.
Confidential: approved tools, only when needed. Restricted: never.
Check before it goes out: customer-facing text, numbers, legal or HR content,
code that touches payments or security.
Share: save prompts that work in [shared library].
Record decisions made with AI help in [decision log].
Questions: ask [owner]. We review this policy every quarter.
Roll it out in a week
Day 1: Draft it with two or three of your heaviest AI users, not only legal or IT.
Day 2: Share the draft and ask, "What would stop you following this?"
Day 3: Fix the answers. Usually that means approving a tool or loosening a rule that was blocking real work.
Day 4: Set up the approved tools, shared projects and admin settings.
Day 5: Walk the team through it in 15 minutes. Show examples, not clauses.
Then put a quarterly review in the calendar. Add new tools, retire dead ones, and look at what people actually asked about.
Cover agents, not only chat
If your team uses AI agents that take actions, such as editing code or sending emails, add a short section on what they may do without a human. Our guide to guardrails for AI agents covers permissions, sources and audit trails. And if you want good prompts to spread, see turning one person's best prompt into a team skill.
FAQ
How long should a team AI policy be?
One page. If it needs more, move detail into linked guides and keep the policy itself short enough to read in two minutes.
Who should write the AI policy?
One owner, usually from operations, with input from your heaviest AI users and whoever handles security and legal. Policies written only by legal tend to get ignored.
Should we ban personal AI accounts?
Ban personal accounts for internal and confidential data. Banning them for everything is hard to enforce and pushes use out of sight. Make the approved tool good enough that people prefer it.
How often should we update it?
Every quarter, and whenever you add a tool, change a plan, or have an incident.
The short version
A team AI policy works when it is short, sorts rules by data type, gives people a strong approved tool with real company context, and has an owner who updates it. Write it with the people who use AI most, roll it out in a week, and review it every quarter.
We're building Shane to give every approved AI tool your team's context with permissions built in, so the policy and the easy path point the same way. If that's a problem your team has, you can join the waitlist at tryshane.ai.