[COMPANY NAME] · Effective [DATE] · Next review [DATE + 90 DAYS] · Owner: [NAME, ROLE]
Why this exists
We use AI tools because they save real time. This page sets out what’s fine, what needs care, and what is off limits, so that using them never puts our clients’ information, our people’s privacy, or our reputation at risk.
It applies to everyone doing work for us: employees, contractors, and freelancers. It takes three minutes to read. Please actually read it.
Approved tools
| Tool | Use it for | Account |
|---|---|---|
| [Claude] | [Writing, analysis, client docs] | [Company] |
| [ChatGPT] | [Research, brainstorming] | [Company] |
| [Gemini] | [Anything in Google Workspace] | [Work login] |
Use the company account wherever one is listed. Personal free accounts often reserve the right to train on whatever you type into them. That difference is why this table exists. To request a tool that isn’t listed, ask [NAME] first.
The three tiers
Everything you might put into an AI tool falls into one of three tiers. When in doubt, treat it as Yellow.
GREEN — go ahead. No approval needed: drafting, rewriting, summarizing, or editing anything already public or internal and non-sensitive; brainstorming, outlining, planning; learning something new; improving the tone or clarity of your own writing. In short, anything you’d happily read aloud in a client meeting.
YELLOW — sanitize first. The substance is fine to share; the identifying details are not. Replace the specifics with placeholders before you paste.
Instead of: “Acme Dental’s Q3 revenue was $412,000 and they’re behind on invoice #4471.” Paste: “[CLIENT A]‘s Q3 revenue was [AMOUNT] and they’re behind on [INVOICE].”
You get the same quality of help without handing over anything real. This covers client work where the problem matters but the client’s identity doesn’t, figures you can round or scale, and documents once names, addresses, and account numbers are stripped.
RED — never, in any tool, including paid ones.
- Client or customer names together with their financial or personal details
- Employee records: pay, reviews, medical, disciplinary, personal contact details
- Passwords, API keys, or any login credential
- Anything under an NDA or marked confidential
- Advice from our lawyers, or anything else privileged
- Health information about any identifiable person
- Our trade secrets: pricing models, proprietary processes, unreleased plans
The gut check
Before you paste anything, ask yourself one question:
Would I be comfortable if this exact text showed up in a competitor’s inbox?
If the answer is no, sanitize it or don’t paste it.
Before AI output leaves the building
A person reviews and edits anything AI helped produce before it reaches a client, customer, candidate, or the public. You are accountable for what you send. The tool is not. Check three things every time:
- Facts, figures, names, and dates are correct. AI invents these confidently and fluently. This is the most common way AI work embarrasses a business.
- It sounds like us, not like a template.
- Nothing sensitive ended up in the output, including anything carried over from earlier in the conversation.
Telling people we used AI
[Choose one, delete the rest.]
- We disclose AI assistance on [e.g. published articles and marketing], not on internal drafts.
- We do not routinely disclose it, because a person reviews and takes responsibility for all outgoing work.
- Ask [NAME] before disclosing on any client deliverable.
If something goes wrong
If you think you pasted something you shouldn’t have, tell [NAME] the same day. You will not be in trouble for reporting it.
We can usually act fast, by deleting the conversation, rotating a credential, or giving a client a heads-up, but only if we know. Staying quiet is the one thing that reliably turns a small mistake into a real problem.
Who owns this
[NAME, ROLE] owns this policy and answers questions about it. It is reviewed every 90 days, because these tools change faster than most company policies do. If the review date above has passed, ask [NAME] for the current version.
Acknowledgement
I have read and understood this policy.
Name: ____________________ Signature: ____________________ Date: __________
This template is general guidance, not legal advice. If you operate in a regulated industry (healthcare, financial services, law) have your counsel review it before adopting it.
From the Business Prompting Playbook, which teaches the prompting method behind the sanitizing technique above, plus a prompt library you build and keep. thebusinesspromptingplaybook.com