A workable generative AI use policy fits on one page and answers four questions: which tools are approved, what data may go into them, who checks the output, and what happens when someone breaks the rules. Write it in plain words and pair it with technical checks.
Why write one
A Samsung memo reported in 2023 said engineers had uploaded internal source code to ChatGPT, and that company data entered into such tools sits on external servers, where retrieval and deletion are hard. The company restricted use, and the memo called the restriction temporary. A ban alone leaves people without a safe option. A policy gives them one.
The sections
1. Scope. Who and what it covers: employees, contractors, personal devices if work data is involved, and browser tools as well as editor plugins.
2. Approved tools. A short list, with an owner for each. State plainly that unlisted tools are not allowed for work data. Add a way to request a new tool, so review does not become a bottleneck.
3. Data rules. The heart of it. Use categories people recognize:
- Never: credentials, private keys, customer personal data, unreleased financial results.
- Only in approved tools: source code, internal documents.
- Fine anywhere: public information.
4. Output responsibility. The person who uses the output owns it. Code gets reviewed like any other code. References get checked in primary sources. The Mata v. Avianca sanctions in 2023 show what happens when nobody checks. See a verification checklist for AI generated references.
5. Agents and automation. If tools can run commands or call services, state what they may touch. Agents get their own scoped credentials, never a person's.
6. Incident reporting. If someone pastes something they should not have, they report it quickly and without blame for honest mistakes. Quick reports let you rotate secrets in time.
7. Review cycle. Revisit every six months, or when a tool changes its terms.
Pair words with controls
A policy people can ignore is weak. Add:
- secrets scanning in editors and repositories
- network or browser controls for unapproved tools where you can apply them
- logging for approved tools
- onboarding that shows two or three real cases
What to avoid
- Vague phrases like "use good judgment" with no examples.
- Long documents nobody reads.
- Punishing early reporters, which teaches people to hide.
Safeguard's policies, gates and guardrails and its compliance and evidence automation can help you enforce and prove parts of this in the development workflow. The wording and legal review of the policy itself should come from your own counsel.
Quick check
Should the policy name specific tools?
Name approved tools, but keep the list in a linked page so you can update it without rewriting the policy.
Do we need legal review?
Yes, for employment and data protection wording. This post is a structure guide, not legal advice.
Sources
- CSO Online: Samsung bans staff AI use over data leak concerns
- LawNext: Court imposes sanctions on lawyers who filed bogus cases after relying on ChatGPT, June 2023
Last reviewed: 19 October 2026.
