How to write a company AI usage policy: a step-by-step guide

Someone in accounting tidies up an email with AI, the sales team has a chat assistant draft a quote, and the production lead asks one why a machine keeps failing. Most of this is well meant and genuinely saves time. But if the company has no rules, everyone is making their own call. One day a customer list, a payroll sheet or a confidential offer can end up pasted into an outside tool without anyone noticing.

That is why you don't need a big compliance project. You need a short, clear AI usage policy. This guide gives you a roadmap for writing a first version in a single afternoon, with no technical background required.

Why you need a policy now

In November 2025, the Turkish Personal Data Protection Authority (KVKK) published a guide on generative AI and the protection of personal data. It points out that the Turkish Personal Data Protection Law, Law No. 6698, is technology neutral. If personal data is processed at any stage of an AI tool's lifecycle, the law applies.

The same guide lists the main risks of these tools. Outputs can be wrong, inconsistent or biased. Data privacy and security, intellectual property violations and misleading content such as fake images or voices are also among the key risks it highlights.

If you export to Europe, there is one more reason. According to the European Commission's questions and answers page, the AI literacy obligation in the EU AI Act still applies. No specific level is required, but companies are expected to take measures that help their staff use these tools with awareness. A written policy and a short training session are among the most sensible first steps in that direction.

What does a good policy look like?

A good policy is clear, not long. Two or three pages that an employee can open at their desk and read in two minutes is enough. The goal is not to ban things but to make safe use easy. A purely restrictive document pushes people to use tools in secret, which is the riskiest outcome of all.

The US National Institute of Standards and Technology (NIST) released a voluntary AI Risk Management Framework on January 26, 2023. On July 26, 2024, it added a profile specifically for generative AI. That profile centers on 13 risks and more than 400 suggested actions to manage them, grouped under four functions: govern, map, measure and manage. A small business does not need all 400 actions. But those four functions make a good skeleton for your own policy.

Writing the policy, step by step

1. Name an owner

The policy needs an owner. That could be the general manager, the IT lead or the operations manager. When staff ask "can I use this tool?", they should know who to go to. This is the simplest form of the govern function.

2. List current use

Start by asking each team a short question: which AI tools do you use, and for what tasks? The answers may surprise you. Chat assistants, translation tools, image generators, meeting note apps and assistants built into office software can all show up. This is the map function.

3. Sort tools into three groups

Classify the list with a simple traffic light approach:

• Approved tools: Tools the company has a contract or business account for, with data processing terms that have been reviewed.
• Limited use: Tools that may be used only for work that contains no personal or confidential data.
• Banned tools: Tools with unclear data terms or that cannot be trusted.

4. Classify your data

This section is the heart of the policy. Tell staff plainly which information must never be entered into an outside tool. Examples include customer and employee personal data, health information, salary and payroll details, confidential offers and price lists, technical drawings and production recipes, and passwords and access details. As the KVKK guide stresses, once personal data is processed, every obligation under the law applies, including rules on transferring data abroad and the duty to inform the people concerned.

5. Write the review rule

AI output is a draft, not a final decision. Every text that goes to a customer, every technical value and every legal or financial figure should be checked by a person. This rule stops wrong or invented information from leaving the company under your name. It maps to the measure function.

6. Add a transparency principle

Decide how you will disclose the use of AI in customer correspondence or published content. For images and audio in particular, it is wise to fully ban anything that imitates a real person.

7. Define incident reporting

What should an employee do after pasting confidential information into a tool by mistake? Set up a simple way for them to tell the policy owner right away, without fear of punishment. A mistake found early does far less damage than one that stays hidden. This is the manage function.

8. Train and review regularly

Sending the policy by email is not enough. Walk through it in a short thirty-minute session with real examples. Because tools change quickly, review the policy at least every six months and update the approved tool list.

Common mistakes

• Banning everything: Staff start using tools on their personal phones and you lose all visibility.
• Writing in legal language: A policy nobody reads is the same as no policy at all.
• Treating it as a one-off: When a new tool or a new use case appears, the policy should be updated too.
• Giving no examples: "Confidential information" means different things to different people. Write concrete examples.

A simple outline

Your policy's table of contents could look like this: purpose and scope, policy owner, approved and banned tools, information that is never shared, the human review rule, transparency, incident reporting, and the training and review schedule. Two or three sentences per heading is enough for most small businesses.

Frequently asked questions

Does a small business really need a policy? Yes. Even with a few employees, the risk to personal data and trade secrets is the same. A short document can prevent a big problem.

Is this article legal advice? No. It summarizes official sources. For a specific use that involves personal data, consult a legal adviser.

Conclusion

An AI usage policy is one of the cheapest ways to protect your company and help your staff get real value from these tools safely. Name an owner, list current use, spell out what must never be shared and start with a short training session.

If you would like to map where AI and automation are used in your company and set up a safe starting framework, AtomAxis can help with that first step.