"Client personal data, contracts, unpublished prices, proprietary code."
3
Who reviews what goes to the client
One person or role per type of output. AI does not sign.
"Quotes: the sales manager. Client emails: whoever sends them."
4
Who you ask when in doubt
A name, not a committee.
"Ana (IT) for tools. Luis (legal) for data."
5
How often this policy is reviewed
A fixed date and who convenes.
"Every quarter. HR convenes."
Signed and dated: ____________________ · Next review: ____________
How to fill it in 30 minutes
Bring together one person from IT, one from legal or compliance and two area leads. Thirty minutes, one meeting.
Fill points 1 and 2 first. Almost every company already has them in mind; they just need writing down.
Spend half the time on point 3. This is the real discussion: who reviews what AI writes for a client.
For point 4, write a name. If you write "the AI committee", nobody will ask.
Put a review date in point 5 before you leave the room.
The most common mistake: trying to make it perfect. It will be imperfect and it will work. A policy that exists protects more than a policy that is still being drafted.
The line that is almost always missing
Point 3. Companies write which tools are allowed and which data is banned, and forget the output: the quote, the email, the proposal AI helped write and someone sent. AI does not sign. A person signs, and that person has to be named here.
Vic Sol · Decision Desk · vicsol.org/resources/ · Free to use with attribution. This sheet structures a conversation; it is not legal, financial or audit advice.
Open the .docx in Word (or the .xlsx in Excel) or print it before the meeting.
Fill the fields with the team; leave the blanks visible, they are the discussion.
Close with one owner, one date and one next action. Nothing else.
Prompt
Generate this sheet for your case
Paste this prompt into ChatGPT, Claude or Gemini together with your proposal, process or policy. It reproduces the sheet with your data and flags what is missing.
Act as an HR director with experience in companies of 100 to 1,500 people who has written technology-use policies together with IT and legal, and who prefers one page that gets followed to a manual nobody reads.
Context I am giving you:
- Company and sector: [e.g. professional services firm, 300 people]
- AI tools already in use, approved or not: [ ]
- Types of sensitive information we handle: [ ]
- What leaves the company with AI help (quotes, emails, reports): [ ]
- Current policy or manual, if any: [paste text or write "none"]
What I need: write our AI policy on a single page with exactly these five points, in this order:
1. Approved tools (name and purpose).
2. What never gets pasted into an AI (types of information).
3. Who reviews what goes to the client (one person or role per type of output; AI does not sign).
4. Who you ask when in doubt (a name or role, not a committee).
5. How often this policy is reviewed and who convenes.
Output format: a table with the columns Point · Rule · Owner, followed by three lines for signature, date and next review. Maximum 300 words. No introduction.
Rules:
- Do not invent people's names or tools; where data is missing, write [PENDING] and tell me which question to ask to complete it.
- Where point 3 is left empty, flag it explicitly: it is the line that is almost always missing.
- If critical information is missing, ask me at most 3 questions before answering.
- Answer in plain, direct business English, with no sales adjectives and no promises.
What to check in the answer:
Does point 3 name a person or role for each type of output, or did it fall back to "the team reviews"?
Does point 4 have a concrete name, or did it hide behind a committee?
Does it fit on one page? If it runs past 300 words, ask it to cut without dropping any of the five points.
Vic Sol