An AI policy should help people make decisions. If it only contains broad principles, employees may still be unsure what they can do on Monday morning.
For SMEs, the best policy is often practical, short enough to use, and clear enough to guide real behavior.
1. Which AI tools may employees use?
Employees need to know whether the company has approved specific tools, prefers certain platforms, or requires review before new tools are used for work.
2. What data is not allowed in AI tools?
This is one of the most important questions. A useful policy explains the difference between harmless general information and sensitive business, customer, employee, or confidential data.
3. When is human review required?
AI-generated output should not automatically become company output. The policy should explain when a person must check accuracy, tone, completeness, and risk before anything is used.
4. Which use cases need approval first?
Some AI use is low risk. Other use cases touch customers, personal data, legal commitments, finance, HR, safety, or important decisions. These should go through a simple intake or review step.
5. Who owns AI questions internally?
If employees have no place to ask questions, they will make their own decisions. A practical policy should name a role, team, or process for AI questions and new ideas.
6. What should be documented?
Not every prompt needs a formal record. But AI initiatives, approved tools, higher-risk use cases, and important decisions should be visible enough to review later.
7. What happens when something goes wrong?
Employees should know how to report a possible AI-related mistake, data issue, or risky output. A simple reporting route is better than silence.
What this checklist cannot solve alone
These seven questions are a starting point, not a complete governance framework. Every company still needs to adapt its rules to its tools, data, people, processes, and risk appetite.
The policy works best when it is connected to training, intake, review, and leadership ownership.
Need clearer AI rules before usage spreads?
If your company is already using AI but does not yet have clear rules, an AI governance review is a practical place to start.