Your staff are already using AI tools. Some are using them well. Some are pasting customer records into free chatbots. Most are somewhere in between, and nobody has told them where the lines are.
Banning AI does not work; people simply use it on their phones. What works is a short, clear policy that tells people what is allowed, what is not, and who to ask. Here is one in eight clauses. Adapt the wording, but keep it short enough that people actually read it.
1. Approved tools
Staff may use the AI tools on the approved list for company work. The list names each tool, the plan or account type, and what kind of information it may be used with. Anything not on the list needs approval first.
This is the most important clause. A business subscription to a tool usually comes with very different data terms from the free version of the same tool.
2. Information you must never enter
Never enter the following into an AI tool unless that tool is approved for it: personal information about customers or staff, passwords or access keys, unreleased financial results, legal advice, or anything marked confidential.
Under POPIA, sending personal information to a third-party service is processing, and you remain responsible for it.
3. Human review
AI output must be reviewed by a person before it is sent to a customer, published, used in a decision about a person, or relied on for anything financial or legal. The person who sends it owns it.
4. Decisions about people
AI must not be the sole basis for decisions that affect a person's employment, credit, pricing or access to services. Where AI informs such a decision, a person must be able to explain the decision without referring to the tool.
5. Disclosure
Tell customers when they are talking to an AI system rather than a person. Do not present AI-generated images or recordings of real people without their consent.
6. Intellectual property
Check that you have the right to use what you put in, and be cautious with what comes out. Do not enter third-party content you do not have rights to. Treat AI-generated code and copy as a draft that needs review.
7. Building automations
Anyone building an automation or agent that uses company data or acts on company systems must register it with the named owner before it goes live. Registration records what it does, what data it touches, and who is responsible.
8. Ownership and review
A named senior person owns this policy and the approved tools list. Questions go to them. The policy is reviewed every six months, because the tools change faster than most policies.
Making it stick
A policy only works if people know it exists. Send it with a short explanation, run a 30-minute session per team showing what good use looks like, and make the approved tools easy to get. If the approved route is harder than the unapproved one, people will take the unapproved one.
Rules first, then tools. Once people know the lines, they use AI more, not less, because they are no longer worried about getting it wrong.