Most AI policies I've seen are either too vague to enforce or too long to read. A good AI policy is short, specific, and structured so your team can actually use it.
The Structure
Your AI acceptable use policy needs four sections. That's it.
Section 1: Approved tools and tiers
List every AI tool that's sanctioned for use at your company, the specific plan or tier that's approved, and who's authorized to use it. Be explicit. "Claude Enterprise with HIPAA mode enabled" is an approved tool. "Claude" is not specific enough.
Include a clear statement: any AI tool not on this list requires approval before use. Give people a way to request approval (a Slack channel, a form, an email address). Make it easy or they'll skip it.
Section 2: Data classification rules
Define what can and cannot go into AI tools. Use your existing data classification if you have one. If you don't, create a simple one: Public data is fine for any approved tool. Internal data needs approved enterprise tools only. Confidential data (customer data, financial data, IP) needs approved enterprise tools with appropriate agreements. Restricted data (PHI, PII, credentials, secrets) needs approved tools with BAA/DPA and appropriate technical controls, and never belongs in consumer-grade tools. One sentence per category. No ambiguity.
Section 3: Human oversight requirements
Any AI-generated output that goes to a customer, goes into a product, influences a clinical or business decision, or gets published externally requires human review before it's final. No exceptions. This isn't about not trusting AI. It's about accountability. When something goes wrong (and it will), you need a human who reviewed and approved the output.
Section 4: Agentic tool rules
For tools like Cowork, Claude Code, and any AI that can take actions (execute code, modify files, access systems, browse the web), define: who can use them, the default mode ("ask before acting" for anyone with privileged access), what systems and applications are blocked, and what approval is needed before using agentic AI on production systems or with sensitive data.
How To Roll It Out
Don't email a PDF and hope for the best.
Do a 30-minute all-hands or team meeting. Walk through each section. Give real examples of what's allowed and what's not. Show the approved tools list. Explain why the rules exist (customer trust, regulatory requirements, data protection) without being preachy about it.
Make the policy findable. Pin it in Slack. Put it in your wiki or handbook. Link it from your onboarding checklist.
Keep It Alive
Review the policy quarterly. AI tools change fast. New tools appear, existing tools add capabilities, BAA coverage shifts, your business needs evolve. A policy that's 6 months out of date is a policy that nobody trusts.
Assign an owner. Someone needs to be responsible for maintaining the approved tools list, processing approval requests, and updating the policy when things change.
Up next in the series
In Part 3, we'll set up the technical controls that enforce what the policy says.
Read Part 3 →