"How do we create a policy for using AI?" Start with three basics: define what data employees may and may not enter into AI tools, require human review of all AI-generated content before it is shared externally, and designate someone responsible for monitoring how AI is being used. A one-page acceptable use policy is sufficient to start — it does not need to be comprehensive on day one. What matters most is that expectations are clear and documented before a problem occurs.

​

Revisit the policy regularly, because the technology and the legal landscape are both evolving quickly. What was acceptable practice eighteen months ago may be out of step with current guidance from regulators, funders, or professional associations. Building in a quarterly or annual review cycle ensures your policy stays relevant without requiring a constant overhaul.