Write your organisation's AI rules in one hour

What happens to your information

What it costs

Before you start

• The person who can approve the rule and one named deputy.
• Two to four staff who handle programmes, sensitive records, reporting or operations.
• Paper or an existing word processor and a secure place for the master copy.
• A blame-aware discussion of current practice, held verbally or with temporary notes.

The steps

1. Step 1 / 8

   Open with the outcome: one approved page that staff can use under deadline pressure. Ask which AI tools and tasks are already in use, but collect answers verbally and do not name people or cases in shared notes.

   Check it worked

   The room has a factual tool-and-task list without creating a new record of who exposed what.

2. Step 2 / 8

   Create three columns: PUBLIC, INTERNAL and IDENTIFIABLE. Put two real work examples in each. Treat voices and combinations of details as identifiable when they could reveal a person.

   Copy this exactly

   CopyCopied

   PUBLIC: deliberately published material
   INTERNAL: routine unpublished work
   IDENTIFIABLE: names, voices, locations, testimony, case details, or combinations that point to a person

   Check it worked

   A new colleague could place the three most common documents your team handles without guessing.

3. Step 3 / 8

   Write one route for each lane. Public may use an approved hosted tool. Internal needs an organisation-approved account and storage route. Identifiable stays local, is minimised, or uses no AI.

   Check it worked

   Each lane names an allowed route and a prohibited route. No line says only that a brand is safe.

4. Step 4 / 8

   Build the approved-tools table from current official terms. Record product, plan, workspace, permitted task, highest data lane, owner, settings checked, source and review date.

   Copy this exactly

   CopyCopied

   Tool | Plan and workspace | Permitted task | Highest data lane | Owner | Settings checked | Source | Review date

   Check it worked

   Every hosted entry identifies the exact account and plan. Every local entry has passed a network-off test. An Ollama model ending in -cloud is not recorded as local.

   Note

   A training control does not prove that content is not transmitted, stored, retained, reviewed or disclosed.

5. Step 5 / 8

   Write the five checks staff must complete: data, input, output, human and record. Name the person who approves exceptions and one deputy.

   Check it worked

   Both people accept the role aloud, and the rule contains no owner called only management, IT or the team.

6. Step 6 / 8

   Write a short incident route: stop, report, record the minimum facts, assess harm to people first, use current product controls, and correct the workflow. Support early reporting.

   Check it worked

   A staff member can say whom to contact today and where the restricted incident record belongs.

7. Step 7 / 8

   Run a tabletop test using a synthetic witness note, an internal budget draft and a published report. Ask the group to choose the lane, route, reviewer and record.

   Check it worked

   The group reaches the written answer without inventing an exception. If not, revise the rule now.

8. Step 8 / 8

   Approve the page, secure the detailed master, circulate a general staff copy, and schedule review after six months or sooner when a tool, law, funder rule or incident changes.

   Check it worked

   The master has an owner, deputy, adoption date, review date, storage location and calendar appointment.