Understand the choices, tailor your rules and create an employee policy.
No personal contact details needed. Your policy is saved when you create it.
Policy progressStep 1 of 6
Step 1 of 6
Your business
These answers shape your starting recommendations and are shared with the other Network tools.
i
This name appears in the policy title. No personal contact details are required.
Use the name employees will recognise.
i
This answer is shared with the other Network tools. It does not change what information employees may give AI.
Include people who regularly use business computers and systems.
i
This sets the starting recommendations for accounts, client information, personal information and agents. You can adjust those recommendations in the next steps.
Consider the consequences of disclosing information or getting an important decision wrong.
i
Microsoft 365 suggests company Copilot; Google Workspace suggests managed Gemini. These are starting suggestions, not verification that a licence or account has the required protections.
Choose the platform that provides your company email accounts.
i
The policy requires company email for work AI accounts as a minimum. A company email address alone does not make an account company-managed or suitable for confidential information. If unavailable, the management checklist asks you to set up company identities.
This flags the need for a separate review of sensitive uses in the management checklist. Sensitive information always requires specific approval; choosing No does not remove that safeguard.
Examples include health records, substantial HR information, legal cases and information about children.
Step 2 of 6
AI today
Current use is separate from what your policy will approve. Existing AI Readiness answers are filled in where available.
i
This describes current use. It does not approve a tool or grant permission to use company information.
Include informal use by staff as well as officially introduced tools.
Tailor the rules in two short steps, or use suggested answers and go straight to the review.
Step 3 of 6
AI accounts and information
Check which accounts staff can use and what information they can share. Suggested answers are starting points for you to review.
i
Work email is an identity safeguard, not proof of business data protection. Personal accounts remain limited to public/general information whatever you choose here.
For example, a staff member signs up individually with their work email.
i
Choose the rule for ordinary internal information. Confidential client information and personal data have separate rules below.
Examples include an internal meeting agenda, process notes or a draft internal announcement.
i
Even a company-approved service may not be suitable for a particular client or contract. This choice controls the policy wording on client information.
Examples include client contracts, unpublished proposals and information supplied in confidence.
i
Removing a name may not remove all identifying details. The policy always limits information to what is needed and requires a separate review for particularly sensitive information.
Examples include a customer name and address, employee details or an identifiable support ticket.
Step 4 of 6
AI actions and responsibilities
Decide how AI-generated work is checked, when AI may act, and who is responsible. Some answers add actions to your management checklist.
i
A familiar software supplier does not automatically make a new AI feature approved. This choice sets when that feature may be used.
Examples include an AI feature within your CRM, accounting software or helpdesk.
i
An agent can take actions using access to your systems. Consequential actions include significant messages, transactions, deletion and contractual commitments.
Examples include sending emails, updating records, placing orders or deleting files.
i
This controls checking before sending or publishing. Important AI output must still be checked before it is relied upon.
Examples include client emails, proposals, social posts and website content.
i
This identifies a use needing closer review. It does not authorise automated decision-making. The employee policy always requires meaningful human involvement.
Examples include shortlisting job applicants, assessing staff or deciding how to treat a customer.
i
Generated code can contain errors or introduce access and security problems. This decides whether to include a specific software-quality rule.
Examples include software development, PowerShell scripts and workflow automations.
i
This is about your business rules, not whether the AI provider keeps chats. The employee policy always says existing retention and deletion rules apply.
Examples include document retention periods and rules for deleting customer or employee information.
i
This role is named as policy owner and receives requests for new services and specific approvals. It should be a role that can obtain suitable technical advice.
Use a role, such as IT Manager, rather than an individual’s name if possible.
i
The policy tells staff to stop, delete the conversation or upload where possible, and report accidental disclosure promptly to this role.
For example, your IT Manager or senior management.
Step 5 of 6
Review your rules
Check every rule below before creating your policy. You can go back to either detail step to change an answer.
Step 6 of 6
Your AI policy
Review the draft before adopting it in your organisation.
Management implementation checklist (separate from employee policy)
