An AI use policy for your company: where to start

ChatGPT, Claude, Gemini and Microsoft Copilot are already part of many people's working habits: to rewrite an email, summarise a document, prepare a draft. Often the company did not decide this: employees started on their own, with personal tools and accounts. The result is uneven use and, above all, no rules on what can be entrusted to these tools.

Why a policy is needed

The reasons are simple:

• Confidential data. What is typed into a prompt leaves the company: client data, commercial information and internal documents can end up where they should not
• Unchecked results. Generative AI tools can be wrong with great confidence: figures, quotations and facts need to be checked
• Uneven use. Without guidance everyone does their own thing: the cautious give up useful tools, the less cautious take risks without knowing it

A clear policy is not meant to forbid: it is meant to help people use AI more safely and more productively.

What to put in a policy

It does not need dozens of pages. A good outline answers five questions:

• Which tools are authorised? Which ones yes, which ones no, and with which accounts (company accounts, not personal ones)
• Which data is never entered? For example personal data of clients and colleagues, confidential or strategic information, credentials and passwords, contract documents
• Who checks the results? The person using the tool remains responsible for the text, figures and statements they take from it
• When must the use of AI be declared? Towards clients and within the company, for work where it matters to know
• Who decides and how is it updated? A contact person for doubtful cases and a regular review, because tools and rules change quickly

This is a general outline, not legal advice: for legal and data protection aspects it is worth involving the person responsible in the company or a specialist consultant.

A policy alone is not enough

A document read once and filed away changes little. Rules work when people know how to apply them: recognising which information is confidential before pasting it into a prompt, building effective requests, checking a result before using it. People learn better by working on concrete cases from their own job than by reading a list of prohibitions.

How BLC works

BLC offers practical, not theoretical, courses on generative AI: you work on ChatGPT, Claude, Gemini and Microsoft Copilot starting from concrete cases brought by the participants, and every session produces results that can be reused in daily work. Security is addressed together with the practical skills: what can be entered into a prompt and what cannot, how to protect company and client data. BLC also offers consulting on data protection and GDPR compliance, with documentation and staff training. It is certified to UNI ISO 21001:2019 and has been active in Ticino since 2007.

Discover the IT & AI courses and the privacy and GDPR consulting. To see how to move from curiosity to productivity, also read Generative AI in the company: from curiosity to real productivity.

Three questions to get started

Which AI tools does your team already use, even personally? What data do they handle that should never end up in a prompt? And who decides, and how are the rules updated when something changes? The answers are the first chapter of the policy.

To see how to train your team, contact us.