Write your company's AI usage policy in the time it takes to read one
Answer eight questions about your team, your data, and your red lines — and get a complete employee AI usage policy in markdown to copy or download. No email gate, no account, and nothing generated: every sentence was written once and reviewed, the questions just choose which ones apply to you.
01 · Your company
Company name and policy owneroptional — the policy works without them
What sector are you in?
How many people does the policy cover?
02 · The rules
What is the most sensitive data your team handles?
Which AI tools are approved today?pick any — or none; “no tools approved yet” is a valid policy
Other approved toolsone per line, or leave empty
Which red lines should the policy name explicitly?three core rules are always included — these add the sector-specific ones
03 · Oversight
How much human review?
When do you tell people AI was used?
What happens when the rules are broken?
04 · Your policy
Answer the six required questions above — or load a sample company — and a complete employee AI usage policy appears here in markdown. Nothing is sent anywhere unless you later ask us to email the policy; it is assembled from written templates inside this page.
What the policy covers
Every generated policy has the same skeleton — the structure public AI acceptable-use templates converge on, from Workable's HR-facing template to Michalsons' governance guidance and ISACA's enterprise version. What your answers change is which branch of each section appears: the data rules for a hospital differ from a design studio, and the tool is honest about that rather than pretending one text fits all.
Purpose & scope
What the policy is for and exactly who it binds — employees, contractors, personal devices included.
Approved AI tools
The allowlist, the approval route for new tools, and the standing rule that anything unlisted is unapproved.
Data rules
What may and may not enter prompts, written as two lists — allowed and never — plus the sector rules that apply to you.
Red lines
The numbered violations: three core rules that never move, plus the ones you selected.
Review & accuracy
Who reads AI output before it counts, from trust-with-baselines to formal sign-off gates.
Disclosure
When and how AI use is declared — internally tracked, told to clients, or governed by sector rules.
Security practices
Accounts, MFA, retention settings, AI features hiding inside other software, and incident reporting.
Incidents & enforcement
What happens when something goes wrong, who hears about it, and what the consequences are.
Review cadence & acknowledgement
How often the policy is re-read, and the signature block that makes it real.
What this is — and what it is not
This is template assembly, and that is the point. There is no LLM writing your policy: each paragraph was written once, reviewed like any policy text, and your answers choose between fixed branches. The same answers always produce the same document, byte for byte — which is what you want from something you plan to enforce.
It is also not legal advice. The generator cannot read your contracts, know your regulator, or see the sixty tools your people are already using that nobody approved. Treat the output as a strong first draft: put it in front of whoever owns data protection in your company, check it against your engagement letters and sector rules, then publish it. A policy you adapted and shipped beats a perfect one you never finished.
The rest of the family works the same way: check your site's agent-readiness, your team's AI skills gaps, or your shadow-AI exposure— instant, ungated, and run entirely in your browser.
From a document to a control
A generated policy answers the question “what are the rules?” — the first question, not the last. An enforceable one is grounded in your actual tool inventory, aligned with the contracts and regulations of your sector, and wired to controls: approval workflows people actually use, training that lands, and telemetry that catches the tools nobody declared.
That is what our AI risk & security assessment does: map every AI touchpoint — sanctioned and shadow — score each finding by data sensitivity and blast radius, and leave you a remediation plan with owners and dates. Bring the policy you just generated; it makes the first conversation concrete. Or start with a conversation — the generator is free either way.
One email a month on practical AI adoption
What we ship for clients, what the tools can honestly do this month, and one thing worth trying in your own team — written by us, no hype, unsubscribe anytime.