Fifteen short sections that cover what most organizations need to say before people use AI at work. Replace each [fill in: …] marker with your decision, delete what does not apply, and publish. No sign-up, no watermark.
Name them. A policy that says "approved tools" without a list is read as "any tool". Keep the list in one place and link to it.
Use the data classes your organization already has. If it has none, the four in section 4 are enough to start.
The person who sends, publishes or acts on AI output owns it. Decide whether some outputs need a second reader, and which.
Decide which audiences are told that AI helped: clients, regulators, the public, colleagues. Most organizations disclose to the first three and not the last.
One named role, a review date, and a way to ask a question. A policy nobody owns is a policy nobody follows.
Every decision left to you is marked [fill in: …]. Search for "[fill in:" to find them all, and replace each marker, brackets included.
Free to copy, adapt and publish inside your organization. No attribution required.
Version [fill in: version, for example 1.0], effective [fill in: date]. Owner: [fill in: owner's role, for example Head of IT or General Counsel]. Questions: [fill in: email or channel].
This policy explains how people at [fill in: organization name] may use artificial intelligence tools in their work, what they may and may not share with those tools, and who is accountable for the results.
It exists so that people can use AI confidently, not so that they avoid it. Where this policy is silent, use the same judgment you would apply to any other tool that handles company information.
This policy applies to everyone who works for or on behalf of [fill in: organization name], including employees, contractors and temporary staff, on any device, for any work-related task.
It covers every tool that generates text, code, images, audio, analysis or decisions from a model, whether it is a standalone product, a feature inside another product, or something built internally.
Use only the tools on the approved list, through the accounts [fill in: organization name] provides. The current list is kept at [fill in: link to the approved tool list] and is maintained by [fill in: responsible role].
Personal accounts on consumer AI products may not be used for work, because their data terms are not ours and their activity is not visible to us.
To request a new tool, write to [fill in: email or channel] with what it is for and what data it would handle. [fill in: responsible role] answers within [fill in: number, for example ten] business days.
Treat information by its class. If you are not sure of the class, treat it as the higher one.
Approved tools may be connected to company systems such as email, calendars, documents and chat only through the connectors [fill in: organization name] has enabled. Each person connects their own accounts and gives the tool no more access than their own.
Do not forward company data to an AI tool through a personal integration, a browser extension or a script that [fill in: organization name] has not reviewed.
Whoever sends, publishes, submits or acts on AI output is responsible for it, exactly as if they had written it. "The AI said so" is not a defense.
Read everything before it leaves your hands. Check facts, figures, names, dates, citations and code. Models state wrong things with the same confidence as right ones.
The following outputs need a second reader before use: [fill in: your list, for example legal and contractual text, anything sent to a regulator, external publications, financial statements, code deployed to production]. Add to this list as you learn.
Do not enter personal data about colleagues, clients or the public beyond what the task needs, and never enter restricted data without written approval.
Do not use AI tools to reproduce copyrighted material, to imitate a specific living person's voice or likeness, or to work around a license.
Output you create for [fill in: organization name] belongs to [fill in: organization name] under your usual terms. Where a client contract says otherwise, the contract wins.
Sign in to approved tools with single sign-on and two-factor authentication where offered. Never share an account.
Never paste passwords, API keys, tokens, private keys or connection strings into an AI tool, even to ask what is wrong with them.
Treat AI output as untrusted input. Code, commands and links it produces are reviewed before they run, and files it generates are opened with the same care as attachments from outside.
Tell [fill in: audiences, for example clients, regulators and the public] when AI materially shaped a deliverable, in the form their contract or the law requires. A short line such as "Drafted with AI assistance and reviewed by [fill in: reviewer's name]" is enough where nothing more specific applies.
Inside [fill in: organization name], disclosure is [fill in: your rule, for example not required, or expected when AI wrote most of a document]. Do not present AI output as your own analysis in a decision meeting without saying so.
Never use AI to impersonate a person, to generate fake reviews, testimonials or records, or to create content designed to deceive.
The following are not allowed with any tool, approved or not.
An AI agent or automation that runs without a person watching is held to this policy exactly as a person would be, and its owner is accountable for what it does.
Before an unattended agent sends anything outside [fill in: organization name], spends money, changes a system of record or deletes data, a person approves that action, unless [fill in: responsible role] has approved a written exception for a specific, bounded routine.
Every agent has a named owner, a written purpose, a limit on what it may touch, and an off switch that the owner and [fill in: responsible role] can reach.
Approved tools keep an audit log of sign-ins, administrative changes and user activity. [fill in: organization name] may review these logs to investigate a security event, a complaint or a suspected breach of this policy, and for aggregate usage and cost reporting.
[fill in: organization name] does not read individual conversations as a matter of routine. When a review is necessary, it is approved by [fill in: responsible role] and recorded.
If you share something you should not have, or you see an AI tool produce something harmful, wrong in a way that matters, or that looks like someone else's confidential data, report it to [fill in: email or channel] the same day. Reporting quickly is never held against you.
[fill in: responsible role] decides whether a conversation, file or account needs to be deleted, whether anyone outside needs to be told, and what changes to this policy follow.
Everyone covered by this policy reads it and acknowledges it [fill in: when, for example at onboarding and annually]. A short practical session on the approved tools is offered [fill in: how often, for example quarterly]; attending once is required.
Managers make sure their teams know which tools are approved and which data classes their work involves.
[fill in: responsible role] owns this policy and the approved tool list, answers questions about it, and reviews it at least every [fill in: interval, for example six months] or whenever a tool, a law or a client requirement changes materially.
Changes are announced to everyone covered, with a summary of what changed and from when.
In the guided pilot and the AI adoption service, IQNOVO writes the policy with you: use cases ranked by value and risk, data classes that match your systems, and the controls configured to enforce them.