Practical AI · 3-minute read
A policy saying ‘use AI responsibly’ leaves employees with a surprisingly large homework assignment. Which tool? Which account? Which information? Who checks the result? Responsibility could use a few nouns.
Start by finding out how work already happens. An AI policy should be understandable at the moment someone is deciding whether to paste a paragraph, connect a folder or send a draft.
Inventory the work before writing the rules
At Mesa Window & Door, a fictional construction supplier, sales uses a chatbot for product descriptions, operations experiments with spreadsheet help, and HR sees AI features inside its existing software. The manager assumed ‘AI use’ meant one website.
Ask each team which tools and accounts it uses, the task, the information involved, any connected systems, and who checks the result. Explain the purpose of the inventory and handle disclosures through a clear process. Include embedded features and personal accounts, not just paid subscriptions.
The next step is a short set of concrete decisions. An employee should be able to determine whether a proposed use is allowed, requires review or needs to stop and be escalated.
Answer the questions people actually have
Which tools, accounts and features are approved for which tasks?
What information may each receive, and what must stay out?
Which outputs need review, by whom, before use?
Which decisions or actions require separate authorization?
Where do people request an exception or report a mistake?
For this fictional supplier, drafting a description from approved public specifications might be allowed. Uploading confidential bids to a personal account would not be. Using AI to rank job applicants would require a separate review of purpose, fairness, applicable obligations and human responsibility.
Using this inventory and our confirmed decisions, draft a plain-language AI quick guide. For each use, show approved account, permitted information, required reviewer and escalation contact. Include one allowed example and one example needing review. Flag missing decisions. Do not invent approvals, legal requirements or vendor privacy protections. Inputs: [approved inventory and decisions].
Test the rules on ordinary situations
Have employees apply the draft to three realistic scenarios. If two reasonable people interpret a rule differently, rewrite it. Have the responsible operational, IT, privacy and HR owners verify the controls and obligations that apply to your business.
NIST’s voluntary AI Risk Management Framework connects policy with defined responsibilities, training and oversight. A readable quick guide is one way to make those responsibilities usable. It does not replace the controls underneath. [1]
Name the policy owner, review it when tools or uses change, and make reporting a mistake straightforward. A rule that everyone can find and explain has a much better chance of influencing Tuesday afternoon than a document everyone clicked ‘acknowledge’ on in March.
Your turn: Which AI decision should your employees be able to make without guessing what management intended?
Source [1]: NIST: AI RMF Playbook, Govern. Policy, responsibilities, training and oversight. The supplier, inventory questions and quick-guide method are original recommendations, not a legal compliance checklist.
