Company AI Tools Inventory and a One-Page AI Usage Policy
Which AI tools are your staff already using? How to build an inventory, sort data into classes and write a one-page AI usage policy that people follow.
rabbitclip teamPublished: 6 min read
Short answer
A company AI usage policy is a short written document that sets out which AI tools staff may use, for which jobs, and with which kinds of data. The first task before writing it is an inventory: listing the tools your team genuinely uses, because in most businesses there are tools beyond the officially approved ones, used through people's own accounts. Once the inventory, the data classes and a single page of rules are in place, the policy becomes something you can enforce and explain to staff.
The aim of the policy is not to ban AI but to make the risk manageable. A ban usually achieves little beyond making the tool invisible, whereas a rule tells people what is allowed and what is restricted. Below we take in turn how to build the inventory, what the rules should contain and how to keep the policy alive.
Why start with a tool inventory?
You cannot manage what you cannot see. Staff start using an AI tool for drafting, translating, summarising or tidying a spreadsheet, often through their own accounts and often without telling anyone. This rarely comes from bad intent; it comes from wanting to get work done faster. But management cannot see which data is going where.
An inventory makes that hidden use visible. The point is not to blame anyone but to draw up the picture, so it is more honest to ask the question as an offer of help than as an inspection: which tools make your work easier, and let us put them into a proper framework.
What should the inventory record?
An inventory can be as plain as a table. Each row is a tool and each column is a question. It should be short enough to fill in easily, and laid out so that team leads can complete it on behalf of their teams.
The headings below are a sufficient start for most companies.
- Tool name and provider
- Which team uses it and for which job
- Whose account it is: a company account or a personal one
- What type of data is entered into it
- How the tool uses the data entered and what its retention settings are
- The tool's owner: the person in the company responsible for it
How are data classes defined?
The most useful part of a policy is sorting data into classes. Putting everything in one category either forbids everything or protects nothing. Three or four classes are usually enough: public information, internal information, confidential information and personal data.
For each class you write which tools may be used. A free tool may be fine for a draft of public text, while a document containing customer data goes only into tools the company has approved after reading their data terms. If each class is illustrated with examples, staff do not hesitate: a price list, a customer name, a contract, an employee record.
Rules on processing personal data vary by country and sector, so this section should be reviewed by a lawyer or a data protection officer.
What should a one-page usage policy contain?
A long policy is a policy nobody reads. One page is short enough for a person to remember. It should separate what is allowed from what is not, leave responsibility with the employee and show where support is available.
The headings below make up the skeleton of a one-page policy.
- The list of approved tools and the jobs allowed for each
- Which data class may go into which tool
- A person reads the output before it is published or sent to a customer
- Whom to ask when someone wants to try a new tool
- Whom to tell, and how, if a mistake or data leak is suspected
How do you keep the policy alive?
A written rule that is never explained stays in a drawer. Presenting the policy to the team in a short meeting with real examples works better than a long email. People follow a rule when they understand the reason for it; if they see only a ban, they find a way round it.
Because tools and providers' terms change often, the policy and the inventory should be reviewed at set intervals, new tools added and unused ones removed. Someone must own this. A single person named on day one stops it becoming nobody's job.
Which mistakes come up most often?
Policies usually fail for the same few reasons.
- Writing a policy without making an inventory first
- Banning all AI use and pushing staff into hidden use
- Writing the policy long and in legal language
- Leaving data classes without examples
- Writing the policy, presenting it once and never reviewing it again
When is a detailed policy unnecessary?
In a very small team where AI is used only for drafts of public content, a long document is an unnecessary burden. A few sentences of shared rules and a single list of approved tools may be enough.
By contrast, in companies that work with customer data, health, finance or law, a simple rule is not enough. Data classes and tool approval need to be written in more detail, and legal advice should be taken.
The test is simple: what is the most sensitive data that could go into the tool. If the answer is a public text, a light rule will do; if it is a customer record, you need a fuller policy. Small teams should ask the question again as they grow or take on a new kind of client; a light rule quietly becomes inadequate once the work grows more sensitive.
An AI policy starts with an inventory, sorts data into classes and ends on a single page. A company that draws a framework instead of imposing a ban speeds up its people's work and also knows where its data is going. If you would like to review the use already under way in your company, you are welcome to arrange a discovery call with rabbitclip.
FAQ
How long should a company AI usage policy be?
One page is enough for most companies. It should clearly cover approved tools, data classes, human checking of output and whom to go to with a question or problem.
How do I find the tools staff use on personal accounts?
Ask in a non-accusatory survey which tools make their work easier. Honest answers come from the promise of a proper framework, not from the threat of a ban.
Is banning AI altogether a solution?
Usually not. A ban does not remove the use, it hides it. Staff carry on using the tool quietly and management cannot tell which data is going where.
Who should prepare the policy?
A manager who knows the work should prepare it together with someone who looks after data and legal matters. Sections on personal data must be reviewed by a lawyer or a data protection officer.
