AI use policy for small teams: a simple starter guide

An AI use policy is a short written rulebook for how your team uses chat assistants at work. Chat tools such as ChatGPT reached millions of people in a few months, and many staff now try them without asking. A small team does not need a legal manual. It needs one page that answers three questions. What may we paste in? Who checks the answer? When do we say AI helped?

Why a small team needs a written policy

Without a policy, every person makes their own call. One person pastes a client contract into a chat box to get a summary. Another sends an AI draft to a customer without reading it. Neither meant harm. Both created a risk that could have been avoided with a few clear lines.

A written policy also protects good use. When staff know the limits, they can use the tools with less worry. Keep the document to one page so people actually read it. Put a date on it and name one person who owns it.

Governments and standards bodies already point the same way. Singapore's Model AI Governance Framework, second edition, was released on 21 January 2020. It asks organisations to set up internal governance, to decide how much human involvement a decision needs, and to communicate clearly with the people affected. Those ideas scale down well to a team of five.

Sources: Personal Data Protection Commission and Infocomm Media Development Authority, Model Artificial Intelligence Governance Framework, Second Edition, 21 January 2020 (pdpc.gov.sg).

Rule one: keep confidential data out

Treat any text you type into a public chat tool as text that leaves your building. Write a plain list of what must never be pasted. A good starter list is short.

• Customer names, emails, phone numbers and addresses.
• Contracts, quotes and pricing that are not public.
• Passwords, access keys and internal system details.
• Staff records, pay and performance notes.
• Anything a client asked you to keep private.

Then give a safe way to get value anyway. Staff can remove names and figures first, or describe the problem in general terms. For example, "write a polite late-payment reminder" is safe. Pasting the whole customer file is not.

Check each tool's own terms before you approve it. Some services keep conversations to improve their systems. Your policy should name the tools the team may use and say who approved them.

Sources: the Singapore framework above asks organisations to manage data and stakeholder communication with care; the tool-specific advice is the editors' practical guidance.

Rule two: a person checks everything

Chat assistants write fluent text, and fluent text can still be wrong. They can state a false fact in a confident tone. So the rule is simple: AI drafts, a person decides.

Spell out what checking means. The reviewer reads the whole output. They check names, numbers, dates and any claim of fact against a trusted source. They fix the tone. They confirm the text says what the team means to say.

Match the level of review to the risk. A brainstorm of meeting titles needs a quick look. A client proposal, a legal notice, or a public statement needs a careful second pair of eyes. Singapore's framework uses the same idea when it asks how much human involvement a decision needs, and weighs how serious and how reversible a harm could be.

The US National Institute of Standards and Technology published its AI Risk Management Framework 1.0 in January 2023. It lists qualities of trustworthy AI, including that a system is valid and reliable, and that it is accountable and transparent. A human check is how a small team makes sure a tool's output meets that bar. The framework is voluntary, and it is built to suit organisations of any size.

Sources: NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023 (nist.gov/itl/ai-risk-management-framework); Singapore Model AI Governance Framework, Second Edition, 2020.

Rule three: say when AI helped

Decide in advance when you will tell people. Staff should know when to note AI use inside the team. Clients should know if AI had a real hand in work they pay for, especially when the contract or industry rules ask for it.

A simple version works well. Inside the team, add a short note to a file when AI wrote the first draft. With clients, answer honestly when asked, and say so up front where it matters. Never present AI output as the personal work of a named expert who did not review it.

Disclosure builds trust. Singapore's framework stresses clear communication with the people affected by AI-assisted work. A calm, matter-of-fact note costs little and avoids awkward surprises later.

Sources: Singapore Model AI Governance Framework, Second Edition, section on stakeholder interaction and communication.

Put it on one page and keep it alive

Here is a starter outline you can copy into your own words.

1. Purpose: why the team uses AI tools, in one sentence.
2. Approved tools and who approved them.
3. Never paste: your confidential data list.
4. Review: who checks output, and how closely.
5. Disclosure: when and how you tell colleagues and clients.
6. Owner and review date: one name, and a date to look at the policy again.

Share it in a short team meeting rather than by email alone. Ask staff for examples of tasks where AI helped and where it failed. Those stories make the rules real. Then revisit the page every few months, because the tools change fast.

A first version does not have to be perfect. A plain page that people follow beats a long one that nobody reads. If your work touches legal, tax or health topics, ask a qualified professional to review your policy. This article is general information, not legal or medical advice.

Sources: the NIST framework describes risk management as an ongoing process that organisations keep applying; the starter outline is the editors' practical summary of the guidance above.

Sources

• NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023: nist.gov/itl/ai-risk-management-framework
• PDPC and IMDA, Model AI Governance Framework, Second Edition, 21 January 2020: pdpc.gov.sg