How to Roll Out an AI Policy So Staff Actually Follow It

Staff follow an AI policy when it fits on one page, when the approved tool is easier to use than the banned one, and when someone visibly checks. Roll it out in four moves: cut it to one page of red lines, brief the team for 20 minutes with real examples, pay for business accounts, and spot-check monthly for three months.

This assumes you already have a policy drafted; if not, start with how to write an AI usage policy and come back. What follows is the launch itself: the wording, a two-week sequence, an amnesty for tools people already use, checks that don't feel like surveillance, and how to tell at 90 days whether it's working. The worked example is an illustrative 11-person recruitment agency, where the obvious risk is candidates' CVs pasted into personal accounts.

Follow me on Instagram@sagnikteaches

Four reasons written AI policies get ignored

It's too long. A 12-page policy gets read once, at signing, and never again. Nobody can recall clause 7.3 while a client is waiting for a shortlist.

Connect on LinkedInSagnik Bhattacharya

The approved route is worse than the banned one. If the business tool has lower limits, needs a request form, or isn't installed on anyone's phone, people use their own free account. That's convenience, not defiance, and the policy has to fix it rather than scold it.

Subscribe on YouTube@codingliquids

There are no examples. "Don't input confidential information" means little until you say "a candidate's CV with their mobile number and home address is confidential".

Nobody looks. If no one ever asks how the tools are being used, staff reasonably conclude the policy was paperwork. Each of the sections below fixes one of these.

Cut it to one page people can remember

Keep the full policy as the reference document. The one-page version is what people actually use, so it should list the approved tools, what's allowed, what's required and what's banned, in the words your team uses. The hardest part is translating. Two clauses from an illustrative full policy, and how each reads on the one page:

The full clauses stay in the reference document, because they define terms the one page can't. But nobody at 6pm recalls "Schedule 2"; they do recall "work account only". Here's the whole one page for the recruitment agency; swap in your own tools and work.

[AGENCY NAME]: AI RULES ON ONE PAGE (version 1, [DATE])

Approved tools: [e.g. our ChatGPT Business workspace / Copilot Chat]
Sign in with your work account. Nothing else for work material.

You may:
- Draft job adverts, client emails, candidate summaries, interview questions
- Summarise CVs and interview notes in the approved tool
- Research companies and markets using public information

You must:
- Read and edit everything before it goes to a client or candidate
- Remove phone numbers, home addresses and dates of birth before pasting
  a CV, unless [NAME] has approved the tool for full CVs
- Tell [NAME] within 24 hours if client or candidate data went somewhere
  it shouldn't. Reporting quickly is never punished.

You must not:
- Let AI decide who is shortlisted or rejected. A person decides.
- Paste anything work-related into a personal or free AI account
- Connect an AI app to your work email, calendar or CRM without approval
- Send AI-written candidate feedback without reading it first

Not sure? Ask [NAME]. Full policy: [LINK]

The shortlisting rule deserves its own line in any recruitment business. AI used to screen or rank candidates is listed as high-risk in Annex III of the EU AI Act; those obligations for stand-alone systems now apply from 2 December 2027, but if you place candidates with clients in the EU it makes sense to keep a person making the call from day one. Screening tools can also carry bias you won't see without testing, which bias checks for AI CV screening covers. Candidates' CVs are personal data under data-protection law such as the GDPR, so ask your data-protection adviser whether your privacy notice covers AI-assisted processing.

Make the approved route the easy route

Most policy breaches happen because the free tool on someone's phone is faster than the approved one. Remove that gap before launch day and most of the policy enforces itself.

• Pay for business seats. ChatGPT Business Standard is $25 per user a month, or $20 billed annually, with a two-seat minimum; Claude Team Standard is priced the same way. For 11 people on annual billing that's about $220 a month. Business plans don't train on your content by default, which is the main reason to pay. Microsoft 365 business plans already come with Copilot Chat at no extra charge.
• Put the app where people work. Install it on work laptops and phones, pin it in the browser, and set up sign-in with work accounts so nobody juggles passwords.
• Preload the useful prompts. Candidate summary, job advert, client update and rejection email templates, saved inside the approved tool, make it quicker than starting from blank on a phone. A shared prompt library shows how to organise them.
• Give a fast yes or no on new tools. If asking for a new tool takes three weeks, people won't ask. Promise an answer within five working days.

The launch fortnight, step by step

1. Day 1: the announcement. Send it from the owner, not from whoever wrote the policy. Template below.
2. Day 2 or 3: a 20-minute briefing in the normal team meeting. Three minutes on why; seven minutes on the one page, using three real examples from your own work (a CV, a client brief, a rejection email); five minutes on the amnesty; five minutes of questions.
3. Day 3: accounts live. Everyone logs in to the approved tool during or straight after the briefing.
4. Days 3 to 10: the amnesty. Everyone lists the AI tools they've used for work in the past six months, with no consequences.
5. Day 10: acknowledgement. Each person confirms they've read the one page, by form or email reply. Keep the record.
6. Day 14: first office hours. Thirty minutes when anyone can bring a question or a task they're unsure about.

Decide before day 1 who else the one page covers. The agency uses two freelance resourcers during busy months, and they handle the same CVs as everyone else but aren't on the staff list, so they would have missed the announcement, the briefing and the acknowledgement. The fix took three steps: send them the one page with the announcement, give them seats in the business workspace while they work for the agency (a Standard seat costs $20 to $25 a month depending on billing, far less than cleaning up a leak), and add a line to their engagement letter saying candidate data may only go into tools the agency provides. Temps, contractors and outside bookkeepers need the same decision.

Subject: Our AI rules, and the tools you can now use

From today, the business pays for [TOOL] for everyone, signed in with
your work account. It's quicker than the free versions and it doesn't
use our material to train its models.

The rules fit on one page (attached). The short version:
use the approved tool, take personal details out of CVs first, read
everything before it goes out, and a person always makes the
shortlisting decision.

If you've been using other AI tools for work, that's fine: please tell
me by [DATE] using the form in this email. Nobody gets in trouble for
anything they list. We need to know so we can approve good tools and
move work off personal accounts.

We'll talk it through at [MEETING]. Questions any time.
[OWNER]

Three examples that make the briefing stick

Rules are remembered as stories, so spend most of the briefing's seven policy minutes on three situations your team meets every week. For each one, say what someone might be tempted to do, what the rule says, and what to do instead.

The CV at 6pm. A consultant wants a two-paragraph summary of a candidate for a client before leaving. Tempting: paste the full CV into the free app on their phone. The rule: approved tool, work account, contact details and date of birth removed first. Instead: open the saved "candidate summary" prompt in the approved tool, paste the CV with the header block deleted, then check every job title and date against the original, because summaries are where AI quietly merges two roles into one.

It's worth putting that failure on screen during the briefing. Here's the saved prompt and an illustrative result from a CV with two jobs at the same employer:

PROMPT: Summarise this candidate for a client in two short paragraphs:
current role and responsibilities, then relevant earlier experience.
Use only what the CV says. Keep every job title and date exactly as
written.

OUTPUT (illustrative):
Currently Finance Manager at a regional logistics firm, where she has
led a team of six since 2019, covering month-end close, budgeting
and the rollout of a new purchase-ledger system...

The CV actually says Assistant Accountant from 2019 to 2022 and Finance Manager only since 2022, with a team of six for the last year. The summary folded two roles into one and credited her with three more years of management than she has. A client who hires on that basis will find out at the reference stage. The prompt already said to keep titles and dates exactly as written, which is why "check every job title and date against the original" is a rule on the one page and not just a line in the prompt.

The client brief. A hiring manager emails a rambling brief with salary bands and the name of the person being replaced. Tempting: forward the whole thread to an AI email assistant someone found online. The rule: no new apps connected to work email without approval. Instead: copy the brief into the approved tool, take out the departing employee's name, and ask for a draft job advert plus a list of questions the brief doesn't answer.

The rejection email. Twenty unsuccessful applicants need a reply. Tempting: let AI write and send all twenty. The rule: a person reads anything that goes to a candidate. Instead: generate one warm template, personalise the first line for the four who were interviewed, and read each before it goes. It's still far quicker than writing them from scratch.

Running the amnesty so people tell the truth

You can't manage tools you don't know about, and staff won't declare them if declaring feels like confessing. That's why the amnesty email says twice that nothing listed will be held against anyone. Shadow AI in small businesses explains how common hidden use is and what it usually looks like.

AI TOOLS AMNESTY: reply by [DATE]
Nothing you list here will be held against you.

1. Which AI tools or apps have you used for work in the last six months?
2. For each one: personal account, free account or work account?
3. What did you use it for?
4. Did any of it involve candidate CVs, client names or fee details?
5. Is there a tool you'd like us to approve? What does it do better?

Sort every tool into one of three piles: approve it, replace it with the approved equivalent, or stop using it. For any "yes" to question four, ask the person to delete the relevant chats from that account. If a significant amount of candidate data went into a consumer tool, talk to your data-protection adviser about whether anything further is needed. The answers to question five often tell you what the approved tool is missing.

For the agency, the sorted replies might look like this (illustrative):

Four tools and ten people from an 11-person team is not unusual, and the grammar extension is the one nobody thought of as "AI" until question one made them look.

Checking without spying

For the first three months, spend 15 minutes once a month on four checks, then drop to quarterly.

• Usage. How many of the 11 used the approved tool this month? If your plan's admin view shows active users, use it. A falling number usually means work has drifted back to personal accounts.
• A small sample. Pick five client-facing pieces that used AI, such as candidate summaries or adverts, and check them against the one page: personal details removed, edited by a person, shortlist decided by a person.
• Three questions at the team meeting. What did you use it for? What did you want to use it for but couldn't? Was anything unclear about whether it was allowed?
• A four-question anonymous pulse at 30 and 90 days: "I know which tools are approved", "The approved tool does what I need", "I know what not to paste", "I'd feel safe reporting a mistake".

Written up, the first month's check for the agency takes a few lines:

AI POLICY CHECK: month 1
Active on approved tool:  7 of 11 (two part-timers, two not yet)
Sample of 5 outputs:      4 meet the one page. 1 candidate summary
                          still had a mobile number in it.
Team questions:           "Can I paste a client's brief with salary
                          bands?" (yes, approved tool); "Does the
                          phone app count?" (yes, if signed in with
                          the work account)
Pulse survey:             10 replies; 3 unsure what not to paste
Actions:                  "candidate summary" prompt now starts with
                          "Remove contact details first"; one-page
                          rule on CVs reworded with an example

Neither action involved telling anyone off. The failed sample showed the saved prompt made the mistake easy, so the prompt changed.

Tell staff exactly what you check. Reading individual chat histories is a different matter from counting active users: before you do it, ask an employment or data-protection adviser what you need to tell people and whether it's proportionate.

When someone breaks a rule

The first row is the one you'll use most. In the agency's second week, a consultant reported that she'd connected an AI scheduling assistant to her work calendar, and only realised afterwards that it could read every invite, including candidates' names and interview times. The owner thanked her, removed the app's access in the account's connected-apps settings that afternoon, and checked whether anyone else had done the same (one had). Then the one page changed: the "connect an AI app" line now adds "this includes browser extensions and any 'Sign in with Google or Microsoft' button on an AI site". Her report exposed a gap in the wording, which is exactly what reporting is for.

One rule overrides the ladder: never punish someone for reporting their own mistake. The first time you do, the next leak goes unreported, and you find out from a candidate instead. Have your AI incident response plan ready before launch so a report on day four doesn't catch you without one.

Signs at 90 days that the policy is working

At the review, publish version two of the one page with whatever the three months taught you, and add the rules to every new starter's first week. Most version-two changes are rewordings that turn a principle into an action. The agency's CV rule started as "Remove phone numbers, home addresses and dates of birth before pasting a CV". After the month-one sample and three unsure answers in the pulse survey, it became "Before pasting a CV, delete everything above the first job title, and any photo. If personal details appear further down, delete those too." Nobody has to decide what counts as a personal detail any more; they delete a block they can see.

Zero reported incidents isn't automatically good news in a team of 11 people using AI daily; it can just mean nobody feels safe saying so. The pulse survey's last question tells you which it is.

Questions about launching the policy

Should staff sign the AI policy?

A signature matters less than a record that each person has read the current version. A reply to the announcement email or a two-question form ("I've read the one-page rules" and "I know who to ask") is enough for most small firms. If you want the policy to be part of employment terms, ask an employment adviser how to add it properly.

What about staff using AI on their personal phones?

The policy should cover work material wherever it's typed, not just work devices. Say plainly that business information goes only into approved tools on work accounts, then make that easy by installing the approved app on work phones or allowing it on personal phones signed in with the work account. A ban on personal devices without an easy alternative mostly drives use out of sight.

How often should the policy be updated?

Review it at 90 days after launch and then every six months, plus whenever you approve a new tool, a vendor changes its data terms, or an incident shows a rule was unclear. Keep a version number and date on the one-page rules so everyone knows which copy is current, and only ask people to re-confirm when something material changes.

Further reads

• Does a Five-Person Business Really Need an AI Policy? — If you're still deciding whether a small team needs one at all.
• AI Acceptable Use Policy for a Small Professional Firm — Policy wording tuned to client-confidential professional work.
• AI Tool Approval Process: How Staff Request a New AI Tool — How staff should ask for a tool that isn't on the approved list.
• How to Onboard New Hires Onto Your AI Tools and Rules — Build the rules into every new starter's first week.
• Shadow AI: How to Stop Staff Pasting Client Data Into Free Tools — Practical controls for staff pasting client data into free tools.
• How to Run a 60-Minute AI Workshop for Your Team — A one-hour session to follow the briefing with hands-on practice.
• How to Handle Staff Who Over-Rely on AI — Signs of AI over-reliance, a conversation script, a three-rule standard to put in writing, and when a pattern needs a formal process.
• How to Scale AI From One Workflow to the Whole Business — How to copy your first working AI workflow across the business: a readiness gate, a playbook template, adjacency rules and a pet shop's nine months.
• AI Change Management for Small Teams: A Practical Plan — An eight-week plan sized for five to twenty people, with a meeting script, a resistance table and a worked nursery example.
• Rolling Out AI in a Bookkeeping Practice Without Losing Control — A staged AI rollout for bookkeeping practices: control points, an inventory of AI already in your software, a pilot, sampling rates and client wording.
• AI Governance Checklist for Small Financial Advice Firms — Eight groups of checks, each with the evidence to keep, so a small advice firm can show how AI is approved, supervised and recorded.
• Can Financial Advisers Use ChatGPT? What Compliance Allows — A traffic-light list of ChatGPT uses for advice firms, which plan passes a compliance review, how to keep records, and a one-page policy to adapt.
• Does Your Translation Business Need an AI Usage Policy? — Turn client restrictions, tool choices and reviewer responsibilities into a short policy your translators can use on each job.
• A Worked AI Implementation Plan for a Small Medical Practice — One small medical practice's 12-week AI plan, from time audit to scribe rollout and phone overflow, with the costs, the numbers at day 90 and the lessons.
• Using AI for Childcare Observations and Learning Journals — Jot what you saw, let AI shape it into your observation format, then the key person confirms links and next steps. Photos never go into general AI tools.
• How to Write an AI Policy for a Small Charity — The seven decisions behind a small charity's AI policy, a complete two-page example, and how to get it through the trustee board and into volunteers' habits.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: ChatGPT Business and Claude Team plan pricing pages, Microsoft 365 business plan pages (Copilot Chat inclusion), EU AI Act Annex III timetable as amended by the Digital Omnibus on AI.