# AI Use Policy

**[Company name]** | Version [1.0] | Effective [date] | Owner: [name, role] | Next review: [date, 3 months from now]

This policy explains how everyone at [Company name] uses AI tools, including AI agents such as Claude Code and Cowork. It is short on purpose. If something is not covered, ask the policy owner before you act.

## 1. Why we use AI

We use AI to take repetitive work off people's plates (drafts, reports, research, admin) so we have more time for clients and for work that needs human judgement. AI supports our decisions. It does not make them for us, and the person who uses it remains responsible for the result.

## 2. Approved tools and accounts

- Approved: [e.g. Claude Code and Cowork on the company Claude Team plan; list others].
- Use company accounts only. Never use a personal or free AI account for company or client work.
- New AI tools, plugins, connectors or MCP servers need approval from [name] before use.

## 3. Data we can and cannot use

- **Allowed:** internal documents, our own templates, public information, and client data in minimised form (only the fields the task needs).
- **Only with approval from [name]:** full client records, financial statements, contracts.
- **Never:** passwords, API keys or tokens; payment card numbers; identity documents; [health, legal or other sensitive data specific to your business]; any data a client has asked us not to share.
- Work on one client's data per folder or session. Never copy data between clients.
- We handle personal data in line with the privacy laws that apply to us and our clients, such as the UK GDPR, the EU GDPR and applicable US state privacy laws. Questions go to [name].

## 4. What always needs human approval

AI may draft these, but a named person must approve before they happen. Full list in our approval matrix [link or file].

- Sending anything to a client, supplier, regulator or the public
- Publishing to our website, social media or ads accounts
- Any payment, refund, discount or change to pricing above [amount]
- Deleting or overwriting records, files or data
- Anything legal, contractual, disciplinary or related to hiring

## 5. How our agents are set up

- Agents run with the minimum permissions they need. Secret files, destructive commands and publishing are blocked in settings.
- Scheduled routines run read-only unless approved otherwise, and every run is logged.
- Changes made by agents are logged. Settings are changed only by [name].

## 6. Checking the work

- You are responsible for any AI output you use or send. Read it before it leaves the company.
- Numbers must cite a source. If AI could not find a figure, it must say so, never estimate.
- New skills and routines are fully reviewed for their first two weeks, then sampled.

## 7. If something goes wrong

If you think data was shared by mistake, a secret was exposed, or an agent did something unexpected: stop, do not try to hide or fix it alone, and tell [name] within [1 hour / same day] at [contact]. Exposed keys are rotated immediately. We learn from mistakes; we do not blame people for reporting them.

## 8. Transparency with clients

We tell clients we use AI tools to support our work when they ask, and we follow any client instruction to not use AI on their data. [Optional: add a line to your terms or proposals.]

---

I have read and will follow this policy.

Name: ______________________  Signature: ______________________  Date: __________

*This template is a practical starting point, not legal advice. Businesses in regulated sectors (health, legal, financial services) or processing sensitive data should have it reviewed by a qualified lawyer or their professional body.*