What should a generative AI policy for employees include?
By Bodhih Training Solutions, Bengaluru · UpdatedThe short answer
A generative AI policy for employees should state which AI tools are approved and for what, which classes of data must never be entered into them, that a named person reviews every AI output before it is used, when AI use must be disclosed, and what records are kept. It should name an owner, explain how to request a new tool, include training, and be reviewed by your legal adviser.
What sections should an AI policy have?
A short, practical policy that people read beats a long one they do not. These sections cover what most organisations need.
| Section | What it says |
|---|---|
| Purpose and scope | Why the policy exists; who and which tools it covers |
| Approved tools | Named tools and accounts, and what each may be used for |
| Data rules | Classes of data that must never be entered; what is allowed |
| Human review | Every output checked by a named person before use |
| Disclosure | When to tell clients, colleagues or readers AI was used |
| Prohibited uses | Uses not allowed, e.g. sole basis for decisions about people |
| Records | What is logged, where, and for how long |
| New tools | How to request and approve a tool |
| Training | Who must complete what, and when |
| Ownership and review | Policy owner, review date, how to report a concern |
Which data should employees never enter into AI tools?
Be specific. “Do not upload sensitive data” is too vague for people to follow. List the classes, with examples from your business.
- Personal data about employees, candidates or customers, unless the tool is approved for it.
- Client confidential information and anything covered by a non-disclosure agreement.
- Passwords, keys, access tokens and system credentials.
- Unreleased financial results and price-sensitive information.
- Source code or designs that are proprietary, unless the tool is approved for it.
- Health, salary or performance information about individuals.
Why does the policy need human review and disclosure?
Generative AI tools can produce confident text that is wrong, biased or out of date, sometimes called hallucination. A rule that a named person checks every output before it is sent, published or used for a decision puts accountability where it belongs.
Disclosure rules tell people when to say AI was involved, for example in client deliverables, published content or anything affecting a decision about a person. Decide this in advance so employees are not left to guess.
How do I roll out an AI policy?
A policy only changes behaviour if people know it, understand it and can follow it in their real work.
- Draft with input from IT, legal, HR, data protection and a few heavy AI users.
- Have your legal adviser review it against the laws that apply to you.
- Publish a one-page summary alongside the full policy.
- Train every employee, with examples from their own role.
- Make approved tools easy to access so people do not use unapproved ones.
- Review the policy on a set schedule, because tools change quickly.
How can Bodhih help with AI policy training?
Bodhih does not provide legal advice and this page is not legal advice. What Bodhih offers is training that puts a policy into practice. The Applied AI courses for Sales, Marketing, HR, Finance and Managers teach safe use, data handling and human review on the learner’s own work. Bodhih Trainer Toolkits include AI & Data Ethics in the Enterprise and AI Governance & Oversight for the C-Suite for internal trainers.
Courses that fit
AI for HR course
Eight HR work products built with AI on your own work, a proctored exam and a credential anyone can verify.
AI course · onlineAI for Managers course
For first-time and new people managers: run your team’s week with an AI assistant, and keep every decision about a person your own.
AI course · onlineAI for Finance course
Reconciliations, close, forecasts, MIS and audit support with AI, with every number tied out and a person signing off.
Related reading
Turn your AI policy into everyday practice
Train employees to use approved tools, protect data and review outputs on their own work, online or in-house.
Questions people ask next
Do we need a generative AI policy if we have not approved any AI tools?
Yes. Employees may already be using public AI tools on personal accounts. A policy, even a short interim one, tells people what is and is not allowed, which data must never be entered, and how to request an approved tool.
Should we ban ChatGPT and similar tools at work?
Some organisations do at first, but blanket bans often push use onto personal devices where you have no visibility. Many prefer to approve specific tools and accounts, set clear data rules and train people. The right choice depends on your data, sector and risk appetite.
Is there a legal requirement to have an AI policy?
That depends on your country, sector and how you use AI, and laws in this area are changing. This page is not legal advice. Ask your legal adviser which rules, such as data protection law, apply to your use of AI.
Who should own the AI policy?
Name one owner, often in IT, risk or the chief operating officer’s office, with input from legal, HR and data protection. The owner keeps the approved tool list current, handles requests, answers questions from employees and schedules reviews.
How often should an AI policy be reviewed?
More often than most policies, because tools and features change quickly. Set a fixed review date, for example every six months, and review sooner when you approve a new tool or when relevant regulation changes.
What records should an AI policy require?
Keep the list of approved tools and who approved them, training completion records, and, for high-stakes uses, a note of where AI contributed and who reviewed the output. Keep records proportionate; logging every prompt is rarely necessary or practical.
Can AI be used for decisions about employees or candidates?
Many policies prohibit AI being the sole basis for decisions about people, such as hiring, promotion or dismissal, and require human review and documented reasoning. Check with your legal adviser, as rules on automated decisions vary by jurisdiction.