Skip to content
DWKD
Sign in Work with Kenny

Template

AI Policy on One Page

Organize the policy around data classes rather than tool names, and name the default — silence becomes whatever the person wanted to do anyway.

A useful AI-use policy helps someone decide what they may put into a tool, which account to use, what to check before sharing the result, and who can resolve an exception. Use this worksheet to make those decisions explicit.

This is a draft to adapt and review, not an approved policy for your organization. The sample permissions, prohibitions and disclosure rules below are proposed wording. Replace them where your contracts, security controls, responsibilities or applicable requirements differ. Do not treat a filled-in worksheet as approval to use a tool or disclose data.

Why this exists

A short staff-facing summary can make everyday decisions easier while linking to the detailed controls behind them. Keep a maintained tool-and-account register alongside your data classifications: a data label alone does not establish that a particular vendor, account configuration or use case is suitable.

The NIST AI RMF Playbook is voluntary guidance for managing AI risks. Its governance guidance emphasizes documented responsibilities, policies and review. This DWKD worksheet is a drafting aid, not a NIST certification or a substitute for that work.

How to use it

  1. Choose the scope. Name the teams and activities the policy covers. Identify the person responsible for approval and review.
  2. Review the sample classes. Classify actual information, not just its filename. Meeting notes or drafts may contain personal or confidential information. Confirm approved tools, account types, uses and handling requirements for each class.
  3. Set an explicit default. Decide where an uncertain case goes before anyone uploads the data. The sample uses an ask-first default.
  4. Define output and disclosure checks. State who verifies claims and when AI assistance must be disclosed. Routine assistance is not automatically exempt from contractual, organizational or other applicable requirements.
  5. Connect exceptions to a decision log. Record the question, decision, reason and responsible person. Review when incidents, repeated questions or changed tools expose a gap; do not wait for an arbitrary number of repeats.

Try a real decision

Suppose someone wants to summarize meeting notes with a free consumer account. Check what the notes contain, whether that account and use are approved, and what handling rules apply. If any answer is unknown, the worksheet should identify who can resolve it. The goal is a usable decision path, not an automatic yes or no.

Check the draft before adoption

Ask people who will use the policy to try five recent questions without coaching. Record unanswered or ambiguous cases and revise the wording. The five-question exercise is a practical comprehension check, not a validated compliance score. Resolve important gaps even if the other answers are clear.

Have the responsible owners review the final wording and the controls it describes before adoption. Include a usable incident-reporting route and review date. A written rule needs a corresponding operating process; the document alone does not enforce it.

Copy and Clear become available when the worksheet is ready.

-- AI USE POLICY

Owner: Version: Effective:

Next review: date -- no more than six months out

WHY THIS IS ONE PAGE

DRAFT FOR REVIEW: adapt every permission and disclosure rule before

adoption. Anything this page does not answer goes to .

  1. WHAT MAY GO INTO AN AI TOOL

Classify the data and check the approved tool, account and use.

Review both when information, services or requirements change.

CLASS A -- public, or already published

Examples: marketing copy, public pricing, job postings

Only approved tools and accounts for this use. CONDITIONAL

CLASS B -- internal, not sensitive

Examples: internal drafts, meeting notes, process docs

Only tools on the approved list at -- the ones covered

with reviewed training and retention terms. CONDITIONAL

CLASS C -- confidential, contractual, or personal data

Examples: <customer records, employee data, contract terms,

unreleased financials>

Only , only for , never pasted

into a personal account. CONDITIONAL

CLASS D -- never

Examples: <regulated health data, payment card data, credentials

and API keys, material under an NDA that restricts processing,

source code for >

No AI tool. No exception granted at team level. PROHIBITED

  1. THE DEFAULT -- the line most policies leave out

If your situation is not described above, treat it as CLASS C and ask

first. Silence in this document does not mean yes.

  1. THE OUTPUT IS YOURS

AI assistance does not move responsibility. If it goes out under your

name, you checked it.

Check before it leaves, every time:

  • names, numbers, dates, quantities -- verify at the source system
  • citations, links, quotations -- open them
  • legal, medical, financial, safety claims -- route to
  • anything you would not want to be asked to defend
  1. WHEN YOU MUST SAY AI WAS INVOLVED

Disclose where a reader's decision would change if they knew:

  • deliverables where the work product itself is what is bought
  • anything presented as a person's own assessment or testimony
  • <candidate screening, performance review, any decision about a

named individual>

  • published content carrying an author's name

For routine drafting, formatting, code or translation assistance,

follow the approved disclosure rules for the work and audience.

Contractual and other applicable requirements still apply.

  1. DECISIONS A MODEL DOES NOT MAKE ALONE HERE
  • hiring, firing, promotion, discipline
  • credit, eligibility, or individual pricing decisions
  • clinical or safety determinations
  • anything filed with a regulator

A named person decides, on the record, with a stated reason.

  1. EXCEPTIONS

One channel: . One decider: .

Every answer is written to the decision log at :

date | who asked | the actual question | answer | reason

Review this page when questions, incidents or changed requirements

show a gap. Record the decision; do not wait for a fixed count.

  1. IF SOMETHING GOES WRONG

Tell the same day.

<State the real consequence. If it is "it gets fixed and logged, no

blame," write that. If it is disciplinary, write that. A consequence

nobody believes produces silence, not compliance.>

TEST THE DRAFT BEFORE PUBLISHING IT

Write down five questions that were actually asked in the last month.

Answer each using ONLY the page above. No interpreting, no meetings.

  1. ANSWERED? Y / N
  2. ANSWERED? Y / N
  3. ANSWERED? Y / N
  4. ANSWERED? Y / N
  5. ANSWERED? Y / N

Review every N and any ambiguous answer. This is a practical

comprehension check, not a compliance score.

Any answer that surprised you: the page is deciding cases you did not

intend it to decide. Fix that now, not after somebody relies on it.