Guide

How to write an AI usage policy for your organisation

Maangarad AI · 4 October 2026 · 4 min read

Someone on your staff is already using a chatbot for work. Two clear pages tell everyone what is allowed, what is off limits and who to ask.

In most offices the first AI tool arrives on someone’s phone, not through procurement. A programme officer pastes a donor report into a chatbot to get a summary. A finance clerk asks it to tidy up an email to the bank. A new recruit uses it to translate a circular from English into Somali. None of this is wrong in itself. The problem is that nobody has agreed what is allowed, so each person guesses, and guesses about confidential data and factual accuracy tend to go wrong.

A usage policy ends the guessing. It does not need to be long. Two pages that staff read beat twenty that sit in a shared drive. Here is what to put in it.

1. Which tools are allowed, and for what

Name the tools staff may use for work and what they may use them for. A common split: a general chatbot for drafting and summarising material that is already public, and one approved tool, on a paid business account, for internal documents. Anything else needs sign-off first, and the policy should say who gives it. Paid business accounts usually come with better terms on how your data is stored and used than free personal accounts, so if you have them, say so and tell people to use them.

2. What must never be pasted in

This is the section people will remember, so make it concrete. List the kinds of information that stay out of every AI tool unless that tool has been approved for exactly that purpose:

Personal details of clients, patients, students or citizens: names, ID numbers, phone numbers, addresses
Staff records, salaries, performance reviews and anything else from HR
Passwords, access codes, bank details and security arrangements
Contracts, budgets, audit findings and unpublished financial figures
Anything a partner, donor or ministry shared with you in confidence

Then give one rule people can carry in their heads: if you would not pin it on the noticeboard by the front gate, do not paste it into a chatbot.

3. A person checks the output

AI tools write fluent text that is sometimes wrong, and the errors hide in the details: a date, a figure, a name, a quotation, a clause in a contract. The policy should state that a named person reads anything AI helped produce before it is sent, published or used in a decision. Whoever signs the letter is responsible for the letter. The tool is not.

4. When to say AI was involved

Decide when you will tell people that AI was used. A sensible default: disclose it in anything published, anything submitted as research, and anything that directly affects a person, such as an official letter or a decision on an application. Disclosure costs little, builds trust and makes mistakes easier to raise.

5. Ownership and records

State that work produced with AI help belongs to the organisation, like any other work. Ask staff to keep the sources they fed in and the prompts they used alongside the final document, so facts can be traced later. Before any tool is approved, someone should read its terms of service and confirm what the provider does with the content you upload.

6. How to report a problem

Things will go wrong. A confidential file pasted by mistake. A wrong figure that reached a donor. An output that treats one group unfairly. Name the person staff should tell, make it easy to tell them, and promise in writing that honest reports will not be punished. A problem reported the same day is usually cheap to fix. One discovered three months later is not.

Keep it current

Tools change every few months, and so will the way your staff use them. Give the policy an owner and a review date, and update it whenever you approve a new tool. Pair it with a short training session so people understand why each rule exists. Rules people understand get followed. Rules they do not understand get worked around.