Someone has asked you to write the rules. A policy that is only a page of caution gives nobody a decision to make. Three questions do the actual work.
- A policy that only says "be careful" is decoration. It gives no one a decision they can make on a Tuesday afternoon.
- Answer three questions: what may go in, what must be disclosed, who is answerable when it is wrong.
- The third one is the easiest to skip, and it is the one that decides what happens when something goes wrong. Do not plan on "the AI wrote it" working as a defence: a Canadian tribunal rejected an airline's version of it in 2024.
- Consumer accounts are not covered by your company agreements. That distinction decides most of what belongs in rule one.
- Do not enforce with AI detectors. In a 2023 study, seven detectors averaged a 61.3% false-positive rate on essays by non-native English writers; a policy that punishes on a detector score will punish the wrong people.Liang et al., Patterns 4(7), July 2023, read at source 16 Sep 2026: “average false-positive rate: 61.3%”.
- A copyable one-page policy is at the bottom. Adapt it in ten minutes; it is written to be edited, not adopted whole.
Why a page of caution does nothing
The failure to avoid is a document that is entirely about risk and contains no decidable rule. "Use AI responsibly." "Exercise judgement." "Be mindful of confidentiality." Nobody disagrees with any of it, and nobody behaves differently after reading it.
The test is simple. Can someone with a real task in front of them look at the policy and know what to do in under a minute? If not, the policy is not a policy — it is a statement of intent that will be cited only after an incident.
Question 1 · What may go in
This is the rule people actually need, because it comes up several times a day and the answer is not obvious. What each vendor keeps is on what happens to what you type.
The line is the account, not the tool
The important distinction is not "is this tool allowed" but which account is it being used through. A personal consumer account and a company account under a written agreement are governed by completely different terms, even when the interface looks identical.
Assume anything typed into a personal account may be stored and reviewed unless a written agreement says otherwise. Anthropic's consumer terms are one example: chats are kept for five years if you allow them to be used for training and 30 days if you do not, and those terms “do not apply to services under our Commercial Terms, including Claude for Work, Claude for Government, Claude for Education, or API use”.Anthropic, Updates to Consumer Terms and Privacy Policy, 28 Aug 2025, read at source 16 Sep 2026: “We are also extending data retention to five years, if you allow us to use your data for model training.” and “If you do not choose to provide your data for model training, you’ll continue with our existing 30-day data retention period.” See what happens to what you type for the other major vendors, with dates.
Name the categories, not the vibe
"Be careful with sensitive data" fails because sensitive is subjective. A list is not.
Redaction counts. Removing names and identifiers moves work from the first row to the third, and saying so in the policy is what makes people do it.
The rule is about the account, not the tool. Never paste the named categories anywhere, and keep internal material on company accounts.
Question 2 · What must be disclosed
Disclosure that is not theatre
Disclosing every use of AI is unworkable and quickly becomes a footer nobody reads. The workable version is narrower: disclose where a reader's decision would change if they knew.
The reason to be strict about the first list is not ethics in the abstract. It is that being found out afterwards, having implied otherwise, is a trust problem — and trust problems outlast the project that caused them.
Do not enforce with detectors
A policy that says "we will check submissions with an AI detector" creates a worse problem than the one it solves. In peer-reviewed testing, seven detectors labelled more than half of the TOEFL essays written by non-native English speakers as AI-generated — an average false-positive rate of 61.3% — and at least one detector flagged 97.8% of them. The authors “strongly caution against the use of GPT detectors in evaluative or educational settings”.
A policy that punishes on a detector score will, predictably, punish your non-native speakers. Enforce on disclosure and on the quality of the work, which are both observable. Not on a percentage.Liang, Yuksekgonul, Mao, Wu & Zou, "GPT detectors are biased against non-native English writers", Patterns 4(7):100779, July 2023, read at source 16 Sep 2026 in the open-access copy: the detectors “incorrectly labeled more than half of the TOEFL essays as "AI-generated" (average false-positive rate: 61.3%)”, and “at least one detector flagged 97.8% of TOEFL essays as AI generated”. More on how to spot AI writing. Corrected 16 Sep 2026: this note previously credited the study to "Stanford's release" and quoted a ScienceDaily page, which was published by Cell Press; the figures here come from the paper itself.
Disclose where a reader's decision would change, and enforce on disclosure and quality — never on a detector score.
Question 3 · Who is answerable
The rule that makes the rest work
This is the sentence that is easiest to leave out, and it is the one that decides what happens when something is wrong, because checking the work has to belong to someone:
Everything else follows from it. If you are answerable for the figure, you check the figure. If you are answerable for the code, you read the code. No separate rule about verification is needed, because ownership implies it.
Why it matters more than it sounds: without this line, the implicit policy is that mistakes belong to the tool. Do not plan on that holding up. When Air Canada argued that its website chatbot was a “separate legal entity”, a Canadian tribunal disagreed: “It makes no difference whether the information comes from a static page or a chatbot”. Do not plan on "the AI wrote it" working as a defence.Moffatt v. Air Canada, as reported by McCarthy Tétrault, TechLex, 19 Feb 2024, read at source 16 Sep 2026. A secondary source: the tribunal's decision on CanLII refused automated access and was not read. An earlier version of this page said "'The AI wrote it' is not a defence anywhere", which is wider than any single case can show.
Whoever submits the work owns it. Put that sentence in your policy word for word.
The one-page policy
Adapt this. It is deliberately short, because a policy people finish reading beats a thorough one they do not.
Which tools are approved, by name, with which account. A policy about categories still leaves people guessing about the specific product in front of them.
Who to ask. One named person. Policies without a route to a human answer produce either paralysis or quiet non-compliance, and you will not find out which until later.
A policy is a decision aid, not a disclaimer. If it does not let someone act faster and more safely than they would have without it, it is not doing anything — and the version that gets read is the version that is short.
The claims here about retention, disclosure and detector reliability are sourced on the pages linked above: what happens to what you type, how to spot AI writing, and using AI at work, which covers the same ground for an individual rather than a team.
The template carries no legal weight and is not legal advice. It is a starting structure. If your organisation is in a regulated field, the categories in rule 1 are the ones your compliance people should be editing first.