HR Consulting AI: Sell an AI Policy and Handbook Update Package

Sell an AI policy and handbook update as three bounded deliverables: a client-specific AI use policy, a short handbook clause that points to it, and a staff briefing with examples and an acknowledgement route. Price the work from document review, interviews, drafting and approval rounds. State that the client approves operational rules and a qualified adviser checks legal wording.

A generic policy file is easy to generate and hard to use. The client needs rules tied to its actual tools, data, roles and review points. The consultant's value is finding those facts, turning them into workable instructions and testing whether staff can follow them. The handbook clause should connect the new rules to an existing document, not paste an entire technical policy into a staff handbook.

Find a buyer problem with a clear boundary

A small employer may already have people pasting customer emails, staff notes or client contracts into several AI tools. The buyer's problem is not merely “we need AI wording”; it is uncertainty about permitted uses, approval, record handling and who checks output. Ask which tools are used now, who owns them, what information staff handle, and which decisions must remain human. Do not sell a policy that assumes the client has bought a business plan or has already approved a data-processing arrangement.

Start discovery with four artefacts: the current handbook, privacy or information-security rules, a list of AI tools and a small set of real tasks described without personal details. Ask who may authorise a new tool and who answers staff questions. If the client cannot identify a tool owner, make that an explicit decision in the package. A policy that says “ask management” is weak when no one knows which manager has authority.

Define the product as an update package rather than open-ended HR advice. The base deliverables might be one approved-use policy of a set length, a one-page handbook insert, a 30-minute staff briefing with a question sheet, and one revision round. Exclude individual disciplinary cases, negotiation with vendors, software deployment and legal sign-off unless separately agreed. This helps both buyer and consultant know when the package is complete.

The Complete Excel Course with AI Integration

From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.

By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner

Buy now

Price the three deliverables and review work

Illustrative worked package: a 25-person bakery uses one approved business assistant for marketing drafts, but staff also use personal accounts for rota explanations and customer messages. The consultant quotes a fixed $1,800 for discovery, a permitted-use policy, a handbook clause, a briefing deck outline and one revision. The internal estimate is ten hours: two for discovery and document intake, three for drafting, two for checking tools and privacy terms, one for the briefing, and two for client changes. $1,800 divided by ten gives an internal planning rate of $180 an hour before overhead. This is an example price, not a market benchmark.

Show how a retainer differs. After handover, the client might want a monthly policy-maintenance option for an illustrative $300 covering up to two hours of changes or questions. It should name the response window, unused-time rule and what triggers a new project. If the client adds three AI products or starts processing sensitive employment data, that exceeds a light maintenance arrangement. The consultant should quote a fresh review instead of claiming an unchanged policy covers the new risk.

A simple proposal line can read: “The fixed fee includes the listed documents, one briefing and one consolidated revision after client comments. It assumes one approved tool list, one decision-maker and timely access to the current handbook. It excludes case-specific employment advice, vendor contracting and implementation of technical controls.” The price is meaningful only alongside those boundaries. The HR proposal template offers a fuller scope and change-control structure.

Write the policy around decisions staff actually face

Use short sections: approved tools, allowed tasks, prohibited or restricted information, human review, external communication, incident reporting and ownership. State the approved account type and who may add another tool. Define “personal data” in ordinary language with examples such as a customer address or named staff note. A blanket “never use AI” may be impractical if staff already use it; an unqualified “use AI responsibly” gives no usable boundary.

One illustrative bakery rule could say: “Staff may use the approved business assistant to draft general product descriptions from public menu facts. Do not paste a customer complaint, payment details or an employee's absence record. A manager checks claims, prices and allergens before publishing.” That is stronger than “AI must not produce inaccurate content”, because it names the task, the data boundary and the reviewer. The rule must match the bakery's actual systems and an adviser should assess any legal implications.

For a bicycle repair shop, the permitted task might be a general service explainer. A mechanic could draft “what a brake inspection includes” from approved service notes, then a qualified person checks the safety statements before it goes online. A model must not invent a diagnosis from a customer photo or send a binding repair estimate without human inspection. This sector example shows why the policy should separate drafting from operational judgement.

For an HR team, the restricted task might be a disciplinary letter. The policy can allow AI to format approved facts into a draft only after a case owner and suitable data-processing route have been agreed, while the human handles investigation, fairness and outcome. In many small firms it will be simpler to forbid named case material in general assistants altogether. The consultant should not turn a sample permitted-use list into permission for new data processing.

Make the handbook clause short enough to find

The handbook insert should point staff to the full policy and tell them the three actions they need most: use only approved tools, keep restricted information out, and check and own work before sharing it. Include where to report an accidental upload and who can approve a new use. The clause should use the handbook's existing voice and numbering. Check whether the handbook already says something about confidentiality or social media that conflicts with the new wording.

Use of AI tools: Staff may use only tools and tasks approved in the current AI use policy. Do not enter client, customer or employee information into an unapproved service. Check any AI-assisted work before relying on it or sending it outside the business. Report an accidental disclosure promptly through [named route]. The current policy is held at [controlled location]; ask [role] if a task is unclear.

This is a blank drafting template, not a final clause. The consultant should fill in the route, document location, role and approved-use list, and check the wording against the client's actual contracts and employment obligations. If a handbook has a sign-off process, the new clause must pass that process. Releasing a draft policy in a shared folder without approval can create two competing rule sets.

Give staff a briefing they can apply tomorrow

A useful 30-minute briefing spends less time on model terminology and more on decisions. Show one allowed input, one disallowed input and one output that looks plausible but needs correction. Tell staff where the approved policy lives, how to ask about a new task and what to do after a mistaken upload. Allow questions and capture unclear points for policy revision. The consultant should leave a one-page question sheet, not a long slide deck that staff never revisit.

For the illustrative bakery, put two customer-message drafts side by side. The allowed prompt contains only “write a friendly message about tomorrow's opening hours”. The disallowed prompt includes a named customer's refund complaint and payment details. Ask staff which information crossed the boundary and how to rewrite the task. Then show an AI output claiming an item is allergen-free without evidence. The manager removes the claim and checks the approved product specification before publication.

Another exercise uses a staff rota. A supervisor asks AI to “make shifts fair” from a named spreadsheet with availability and absence notes. Instead, the briefing shows how to ask for generic rota principles or use an approved internal system with proper permissions. The human supervisor still checks contractual hours, preferences and exceptions. This demonstrates a real operational choice, rather than a vague slogan about privacy.

Draft with AI, then verify the client facts

AI can turn discovery notes into alternative policy wording, but it can also invent tools, permissions and legal assurances. Use a sanitised brief: tool categories, allowed tasks, restricted data, review roles and unresolved questions. Do not paste named employee incidents to make the draft “realistic”. Ask for a traceable table mapping every proposed rule to a discovery fact or an owner decision still needed.

Draft a small employer's AI use policy from these approved facts only: one business assistant for public marketing copy; no customer payment details or named employee records; manager checks prices, safety statements and external messages; operations owner approves new tools; accidental upload is reported to the operations owner. Produce a policy, a short handbook clause and three briefing scenarios. Mark every unstated detail "client decision needed". Do not claim legal compliance.

An illustrative AI output may say, “All approved services delete uploaded data immediately.” That was never supplied and may be false. Remove it, ask the client to verify the service terms and write only what the contract supports. Another output might tell staff to delete a chat after an incident; that could interfere with the client's incident record. The safer line is to report promptly and follow the client's approved response process.

Flag wording that changes with the legal regime

UK GDPR and EU GDPR can affect the handling of employee and customer personal data, including purpose, transparency and safeguards. US privacy and employment rules may differ by jurisdiction and context. A single handbook clause cannot be declared suitable everywhere. Mark jurisdiction-dependent terms for a qualified adviser, especially monitoring, automated employment decisions, retention, employee notice and rights to challenge. Do not copy one region's legal wording into another client's policy because an AI model presents it confidently.

On the UK side, the regulator's employment-records guidance asks employers to use staff information fairly, lawfully and transparently, and to limit access to the people who need it. Its guidance on monitoring workers has a section on monitoring tools that use solely automated processes, and its recruitment review stresses meaningful human involvement in automated hiring. Both guidance pages are marked as under review after changes made by the Data (Use and Access) Act, so check for newer versions. These are sources to discuss with an adviser, not a substitute for advice tailored to the client.

If a client operates in more than one regime, produce a common operational core and a marked list of jurisdiction questions for counsel. For example, the universal rule “do not put named absence notes into an unapproved assistant” can be common. The exact notice, lawful basis and staff-rights wording needs local review. Keep those questions visible in the handover rather than burying them in a footnote labelled “subject to law”.

Flag at least these wording points in the handover, each as a question for the adviser rather than a settled answer:

• Confidentiality lines for US clients: a rule such as “never share pay or HR information outside approved systems” can read as a ban on staff discussing their own wages. The National Labor Relations Board says employees covered by the National Labor Relations Act may talk about pay with co-workers whether or not they have a union, and that a work rule prohibiting those discussions is unlawful. Word the AI clause around other people's records and client data, not an employee's own pay.
• Contract status in both: if the handbook says its policies are non-contractual, or carries an employment-at-will statement, check that the new clause does not read as a contractual promise or contradict that statement.
• Privacy notice for UK and EU clients: if the policy permits any staff personal data in an approved tool, ask whether the staff privacy notice and the recorded lawful basis cover that use.
• Monitoring in both: if the client plans to review staff prompts or chat logs, treat that as monitoring and take advice on notice and proportionality before the policy promises it.

Close the package with proof of adoption

Give the client an approval table with separate owners for operations, HR, information security and legal review where those functions exist. In a tiny firm, one owner may wear several hats; write the person's role rather than assuming a department exists. Each reviewer should receive a precise question. The operations owner confirms which tasks staff actually perform. The data owner confirms which information may enter an approved tool. The employment adviser examines wording that affects staff rights or obligations. The final approver chooses the policy version and issue date.

Do not turn every tool's marketing page into a policy promise. If an assistant vendor says business content is excluded from training, that answers one question. It does not tell you whether staff may upload a customer record, whether a connected app can see other files, or whether the client agreed to that processor. For the illustrative bakery, write a tool register with product, plan, owner, approved tasks, permitted data, review date and where contractual evidence is stored. A blank “approved” tick is inadequate when the account type may change.

Test an accidental-upload procedure during the briefing. Ask a fictional staff member to say, “I pasted a customer order with a phone number into my personal AI account.” The correct next action in the sample package is to report through the named incident route, preserve the facts needed for assessment and stop further sharing. The policy should not tell staff to conceal the error or promise that deleting a chat erases every copy. The client's responsible person and adviser decide any notification duties under the applicable rules.

Prepare a handover folder with a clean policy, a marked-up draft showing decisions, the final handbook insert, the briefing sheet, the tool register and an unresolved-questions log. Put version, approval date and owner on each document. A client who later changes assistants should be able to find the old decision, compare the new tool's data terms and update the approved-use list without rewriting everything. A single undated PDF attached to an email is too easy to lose or supersede accidentally.

An illustrative unresolved question might read, “Can managers upload redacted grievance extracts for drafting?” The answer is not silently “yes” because a business plan has a no-training default. Record the proposed purpose, which identifiers remain, who can re-identify the record, the tool and contract terms, and the adviser or data owner's decision. Until the question is resolved, keep the activity outside the approved list. This gives the client an actionable decision rather than a vague note to “consider privacy”.

Set a review trigger as well as a calendar date. Review the policy when the client adds a tool, connects an internal data source, changes who can access chats, starts a new people-related use, or sees a significant error. A quarterly reminder may catch drift, but a new tool can arrive the week after a quarterly review. The retainer option can cover small revisions to the register; major new processing should receive a scoped assessment and separate fee.

Be explicit about the limit of the staff briefing. A 30-minute session can show the approved route and test a few scenarios; it cannot certify that every person will apply the policy correctly in every future case. Ask the client to nominate a contact for follow-up questions and to add the rule to new-starter onboarding. If a staff member asks about an unlisted use, the contact should give a documented answer and decide whether the policy needs an update before the use begins.

Acceptance should require three approved outputs: policy, handbook clause and staff briefing materials. Also agree who publishes the controlled version, who collects acknowledgements and when the client will review tool changes. The consultant can provide a rollout checklist, but should not claim every employee understands the policy simply because a briefing occurred. A short scenario check is more informative than attendance alone.

One month later, the client can sample five real AI tasks without exposing unnecessary content: were they within the approved list, was restricted data kept out, and did a named person review the result? If two of five tasks used personal accounts, the response is to examine access and communication, not just rewrite the policy. This is an illustrative quality check; the sample is too small to claim a company-wide compliance rate.

For broader staff adoption, the AI policy rollout tutorial deals with ongoing behaviour. For a policy from scratch, the owner-facing AI usage policy tutorial covers the foundation. The HR audit checklist is useful when an existing handbook has multiple gaps, while the HR automation boundary helps decide which tasks the policy should permit. The package is complete when the client can point to one approved rule set, staff know where to ask, and unresolved legal points are assigned for review.

Further reads

• Free AI for HR Professionals: Are Free Plans Safe With Staff Data? — Clarify staff-data limits for tool plans.
• Does a Five-Person Business Really Need an AI Policy? — Explain the policy need to a hesitant owner.
• Employee Handbook Template for Clients: Build a Master Copy With AI — Build a controlled handbook master.
• How HR Consultants Use AI for Policies, Letters and Cases — Extend the consultant offer to other drafts.
• How to Use Claude for Recruitment at a Small Agency: Specs and Outreach — Claude for job specs and candidate outreach at a small agency: working prompts, sample outputs and the rules that keep rejection decisions with a human.
• ICAEW AI Guidance for Small Practices: A Client Notice and Staff Checklist — ICAEW's generative AI guide turned into a client notice, terms-of-business wording and a one-page staff checklist for a small accountancy practice.
• AI HR Compliance: Client Questions an HR Consultant Should Answer — A client FAQ for HR consultants: what small employers ask about AI in HR, and what to check on data, decisions, notice and records.
• AI for Civil Engineering Firms: Proposals and Site Reports First — A safe-use map for civil engineering firms: proposals, site reports and minutes first, never stamped calculations, with review sign-off.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Information Commissioner's Office, Collecting and keeping employment records, Employment practices and data protection: monitoring workers, and Recruitment rewired; National Labor Relations Board, Your Right to Discuss Wages; OpenAI Help Center, Data controls in ChatGPT (managed workspaces); Anthropic Privacy Center, Is my data used for model training? (commercial products).