Your team already uses AI. Here is how to set rules in one afternoon.

In most small organizations, AI arrived quietly. Someone used ChatGPT to rewrite a difficult email. It worked, so they used it again for a report, then for meeting notes. A colleague noticed and started doing the same. Today, part of your team probably uses AI every week, each in their own way, and nobody has said what is allowed.

That is not a disaster. But it does create two problems: sensitive information can end up in tools you have never checked, and the real time savings stay hidden in a few individual habits. The good news is that you do not need a 30-page document to fix this. A short policy, written in one afternoon, covers most of the risk.

Step 1: Ask before you write

Start by finding out what is really happening. Send your team a short anonymous survey with three questions: which AI tools do you use, for which tasks, and have you ever entered client or member information? Make it clear that nobody will be blamed. You need honest answers, not perfect ones.

Step 2: Choose your approved tools

From the answers, pick one or two tools you will officially allow. Check their data settings: can your content be used to train the provider's models, and can you turn that off? Business plans often come with stronger commitments. A short list of approved tools is better than a long list of forbidden ones.

Step 3: Sort your information into three levels

This is the heart of the policy. Classify the information your organization handles:

• Public: anything already on your website or in your brochures. Fine to use with AI.
• Internal: procedures, drafts, general planning. Fine with approved tools only.
• Confidential: client files, health or financial information, anything under professional secrecy. Never in a public AI tool.

Step 4: Write down allowed and forbidden uses

Keep it concrete. Allowed: drafting emails, summarizing public documents, preparing a first translation, brainstorming. Forbidden: making decisions about people, giving legal or medical advice, sending AI-written content to clients without review. Add one sentence that matters a lot: anything sent outside the organization is checked by a person first.

Step 5: Say what to do when something goes wrong

Mistakes will happen. Someone will paste the wrong document. Your policy should say what to do next: stop, tell the designated person, note what happened, and fix the cause. When people know the procedure, they report problems instead of hiding them.

Then, share it properly

Do not just email the document. Take fifteen minutes in a team meeting to walk through it and answer questions. A policy that people understand is a policy they follow.

To save time, you can start from our free bilingual AI use policy template. And if you prefer to have it written with you, adapted to your team and followed by training and automations, that is exactly what AI-Ready 30 does.