An AI access policy for small teams.
Copy this, fill in the brackets and adapt it. It's a starting point, not legal advice, so have someone qualified check it for your company.
AI access policy
1. Purpose
This policy explains how we use AI tools safely at [Company name]. It applies to everyone who works with us, on company and personal devices used for work.
2. Approved tools
We keep a list of approved AI tools at [location]. Ask [owner] before using a new tool for work. Free trials count.
3. Data rules
Don't put these into an AI tool unless it's approved for them: customer personal data, passwords and keys, financial records, contracts, and unpublished work. When unsure, ask first.
4. Access
Give each AI tool only the access it needs. Don't grant Full Disk Access, Accessibility or screen recording unless the task requires it and [owner] agrees. Remove access when the task ends.
5. Agents and connectors
AI agents and MCP servers may act on your behalf, so you're responsible for what they do. Review what a connector can reach before you add it, and don't let an agent run commands unattended on systems with customer data.
6. Keys and secrets
Store keys in [password manager]. Never paste them into AI chats or leave them in plain-text files. If a key is exposed, replace it straight away and tell [owner].
7. Checking the output
AI can be wrong. A person checks AI output before it reaches a customer, or before it changes code or records.
8. Reviews
[Owner] reviews AI access every three months, and removes a person's access when they leave.
9. Reporting a problem
If you think AI tools exposed data, tell [owner] at [contact] the same day. You won't be penalised for reporting honestly.