Company AI Use Policy: What It Should Include and How to Implement It

Most Ukrainian companies already use AI — often unknowingly. A manager copies text into ChatGPT, a marketer generates images via Midjourney, and an accountant asks AI to explain a tax. Without a clear policy, this creates risk of data leaks, copyright violations, or unexpected costs.

What Risks Arise from Lack of Policy

An employee might accidentally upload a client database to a public chatbot — violating personal data protection law. If AI generates text that fully copies someone else's article, your company could face copyright claims. If the model gives incorrect advice — say, on tax — and you act on it, the financial liability falls on your business if there are no internal verification rules.

What Should Be Included in the AI Policy

The document doesn't need to be long. Five to seven points covering core usage scenarios are sufficient:

1. Data Sources — what can be uploaded to external AI tools (e.g., anonymized reports) and what is prohibited (client personal data, financial reports, trade secrets).
2. Verification of Generated Content — mandatory fact-checking of AI responses before use in external communications or documents.
3. Accountability — the employee who used the AI is responsible for its errors, not the IT department or external provider.
4. Approved Tools — list of permitted services (ChatGPT Team, Claude Pro, proprietary models) and procedure for adding new ones.
5. Training — mandatory instruction for anyone using AI in their work.
6. Incident Reporting — procedure for reporting possible data leaks or AI errors.
7. Updates — policy reviewed every six months or when legislation changes.

How to Develop the Policy Without a Lawyer

Start with a survey: ask department heads what data their teams already upload to AI. This reveals real practices and gaps. Then build a prohibition list based on personal data protection law and recommendations from the National Commission for Financial Services (for financial data). For the final version, a template suffices — for example, our free organizational chart showing where risks exist in your company.

Definition: Personal data — any information that can identify a person (name, email, phone number, IP address). Definition: Anonymized data — data from which all identifying information has been removed, making identification impossible and recovery unfeasible. Definition: Trade secret — information with economic value because it is not generally known, and reasonable steps have been taken to keep it secret.

Steps to Implement the Policy

Week 1 — Conduct an anonymous survey: who uses AI, for what tasks, and what data do they upload. Week 2 — Based on results, draft the policy (up to two pages) and discuss it with department heads. Week 3 — After leadership approval, distribute the document to all employees and run a 30-minute training (can be a recorded video). Month 2 — Add the policy to new job descriptions and monitor for first violation signals (e.g., via IT helpdesk chat).

How to Engage the Team in Compliance

People follow rules when they understand why they matter. In meetings, show a real example: uploading a client list to a public chat could lead to a fine of up to 50,000 UAH. Encourage reports of potential risks — for instance, thank someone in the company chat for noticing a colleague uploaded a confidential file.

How This Works on Our Side: In our corporate intensive, we train leaders to identify priority AI tasks and build working automations on their data. After the program, your company gets at least three working tools chosen by you, with a money-back guarantee if results aren't delivered. https://course.aiadvisoryboard.me/corporate?utm_source=blog&utm_medium=article_body&utm_campaign=corporate

FAQ

**Do I need a policy if we only use corporate AI versions (ChatGPT Team, Claude Pro)? Yes. Corporate tiers don't remove liability for content you create. They only ensure your data isn't used to train models — but you can still upload confidential information and get incorrect output.

**Can we ban AI completely? Technically — yes, but in practice it doesn't work. Employees will use personal accounts, and you'll lose control. Better to allow use with clear rules than fight shadow usage.

**How often should we update the policy? At least once a year, but ideally every six months, as laws and AI capabilities change fast. If your company adds a new department handling personal data (e.g., HR), review the policy immediately.

Conclusion

An AI policy isn't about restriction — it's about safe use of tools already in your company. Start by analyzing actual usage, create a simple document with data and accountability rules, then train your team. Take the first step tomorrow: ask five department heads what data they upload to ChatGPT or similar tools.