Your team is already asking whether AI can draft the message, summarize the file, or speed up the hiring workflow. The harder question is not whether a tool can do the task. It is whether your organization should approve that use, what information is allowed to go into it, and who reviews what comes out.
This guide walks through that decision in plain terms. It defines what an AI use policy covers, gives you five questions to ask before any new use, and applies them to three realistic scenarios from HR and talent work, small business operations, and nonprofit fundraising.
What Is an AI Use Policy?
An AI use policy explains how employees and leaders may use artificial intelligence at work. It identifies approved tools and activities, information that must not be entered into AI systems, decisions that require human review, and the people responsible for approval and escalation. A useful policy also tells staff what to do when a new AI use falls outside existing guidance.
Policy, Guidance, and a Decision Process Are Not the Same Thing
Organizations often use these words interchangeably. They do different jobs, and most problems show up when one of them is missing.
- Policy
- The rules. What is permitted, what is prohibited, and who is accountable. Approved by leadership and applied across the organization.
- Guidance
- The practical how. Approved tools, examples by role, and everyday do and do-not lists that let staff apply the rules without asking every time.
- Decision process
- The path for anything new. Who reviews a use the policy does not cover, what information they need, and how a yes, a no, or a not-yet gets recorded.
Most organizations that struggle with AI do not lack a policy. They lack the third piece. A new use case appears, and nobody knows who can say yes.
Leaders responsible for building that decision process across an organization can go further in the AI Governance for Talent Leaders workshop.
This guide is educational and is not legal advice. What your organization may do with AI depends on its own policies, the tools and contracts involved, the information being used, and the laws that apply where you operate.
Before You Use AI at Work, Ask These Five Questions
Before anyone opens a tool, five questions surface most of the risk in a proposed use. They work the same way in a 12-person company, a hiring team, or a community nonprofit.
-
What task or decision will AI support?
Drafting a first version of a newsletter is different from ranking applicants or deciding who receives services. The closer AI gets to a decision about a person, the more scrutiny the use needs.
-
What customer, employee, donor, client, or proprietary data will be entered?
Name the actual information. "A few notes" often turns out to include names, contact details, health or financial information, or confidential plans.
-
Is the tool approved for this specific use?
Approval is use-specific. A tool cleared for marketing copy is not automatically cleared for personnel records, and a free or personal account may carry different data terms than a business agreement.
-
Who will verify output accuracy, fairness, and suitability?
AI output can be fluent and wrong. Name the person who checks facts, tone, and impact before anything leaves the team.
-
Who can authorize or escalate higher-risk cases?
If no one can answer this, the use is not ready. Someone has to own the yes, and someone has to be able to say stop.
Where Green, Yellow, and Red Fit
- Green: Move
- Yellow: Question
- Red: Escalate
Inclusion Learning Lab's Green Light, Red Flag framework turns the answers to these questions into one of three signals. Green means the use is approved, protected, and accountable, so the team can move. Yellow means something is unclear and needs an answer before work proceeds. Red means the use should not go forward without the right review and authority.
The framework is an educational decision aid. It does not approve any specific tool or use on your organization's behalf.
AI Use Policy Examples Across Three Workplaces
These are illustrative scenarios, written to show how the five questions apply in practice. They are not reports of real organizations, people, or outcomes.
Using AI to Draft Interview Questions
- Scenario
- A hiring manager is filling a customer success role and wants AI to produce a set of structured interview questions before the first round.
- Why AI
- Good structured questions take time to write, and keeping every interviewer consistent is hard to do by hand.
- What is at risk
- Asking for questions based on the job description is low exposure. Pasting in résumés, interview notes, or anything touching age, disability, family status, or other protected characteristics changes the use entirely. The questions themselves also shape a hiring decision.
- Ask before approval
- Is the prompt limited to the role, its duties, and required skills?
- Is the tool approved for recruiting work, and does it retain what is entered?
- Who checks each question for job relevance and consistency with your hiring policies and the employment rules where you hire?
- Safer next step
- Keep candidate information out of the prompt and draft from the job description only. A recruiter or HR partner reviews the questions for job relevance and fairness before anyone uses them. Bring in legal, privacy, or IT if the use expands to candidate records or screening.
It moves toward Green when the prompt contains only role information and a person reviews the output. It moves toward Red the moment candidate data or automated screening enters the picture.
The same tool can be a low-risk drafting aid or a high-risk hiring input. The difference is what goes in and who reviews what comes out.
Putting Customer Records into an AI Tool
- Scenario
- The owner of a 20-person home services company wants a quick summary of three months of customer complaints to spot patterns. A manager suggests exporting the complaint log, names and addresses included, and pasting it into an AI chatbot.
- Why AI
- There is no analyst on staff, and the log is too long to read line by line.
- What is at risk
- Identifiable customer information: names, phone numbers, addresses, and sometimes account or payment details. AI tools differ in how they store, retain, and use what you enter, and a free account may not carry the same terms as a business plan.
- Ask before approval
- Does the summary need customer names at all?
- Which tool is the business approved to use, and under which account?
- Do customer agreements or applicable privacy rules limit how this information can be shared?
- Who reads the summary before it drives a decision?
- Safer next step
- Remove identifiers before anything is entered, keeping only the complaint text and date. Use the tool the owner has approved for business use. The owner or an authorized manager signs off on the use and spot-checks the summary against the original log.
Identifiable records would go into a tool no one approved. Once the information is minimized and the owner approves the tool and the use, it can move to Green.
In a small business, the owner is often the entire approval chain. Two minutes spent deciding what to remove can prevent a far larger problem.
Using AI to Help Draft Donor Communications
- Scenario
- The development director at a community food program wants AI to help draft a year-end appeal. The most moving material is a client story from a recent intake conversation and notes about several major donors.
- Why AI
- A small team, a short deadline, and an appeal that has to land.
- What is at risk
- Private client details, donor information, and the trust both groups place in the organization. A story shared during intake was not necessarily shared for fundraising. Donor notes can include giving history and personal circumstances.
- Ask before approval
- Has the person in the story agreed to its use, in this form?
- Can the draft be built from general program information instead of private notes?
- Is the tool approved for donor or client information?
- Who checks the final appeal for accuracy, dignity, and alignment with your donor privacy commitments?
- Safer next step
- Use AI for structure and tone, working only from general program information. Add the client story by hand, with documented consent and identifying details changed or removed as your policy requires. The executive director or an authorized program or communications leader reviews the appeal before it goes out.
The drafting support is reasonable. The consent and confidentiality questions need answers first.
For nonprofits, the question is rarely only "Is this efficient?" It is also "Would the people we serve, and the people who support us, be comfortable with how we did this?"
What Changes by Organization Type?
The five questions stay the same. What changes is the kind of information at stake and who usually holds the authority to decide. These are common patterns, not fixed rules, and your structure may differ.
| Audience | Typical use cases | Key oversight question | Relevant decision-maker | Free workshop |
|---|---|---|---|---|
| HR & talent | Candidate communication, drafting HR guidance, workforce workflows | Who reviews outputs that affect people? | HR or talent leadership, with legal, privacy, and IT as appropriate | HR & organizational workshop |
| Small business | Customer communications, operational summaries | What information may staff put into an AI tool? | Owner or an authorized manager | Small-business workshop |
| Nonprofit | Donor communications, program summaries | Does this use protect donor and client confidentiality and the trust people place in us? | Executive director, or an authorized program or operations leader | Nonprofit workshop |
Questions People Ask Before Using AI at Work
Can employees use ChatGPT or other AI tools at work?
Yes, if the organization allows it, and that permission should be written down. Many organizations permit AI for specific tasks, such as drafting or summarizing non-sensitive material, using approved tools and accounts. The most common gap is not a ban or an approval. It is silence, which leaves staff using personal accounts because no one said otherwise. A clear policy names approved tools, permitted tasks, prohibited information, and who to ask when a use is new.
What information should never be pasted into a public AI tool?
As a starting rule, keep out anything identifiable or confidential unless your organization has approved the tool for that information. That typically includes personal details about employees, candidates, customers, donors, or clients; health, financial, or account information; passwords and credentials; and confidential plans or legal matters. Data terms vary by product and account type, so check the specific tool's terms and your organization's agreements rather than assuming every AI tool handles information the same way.
Who should approve a new AI use case?
The person who owns the business outcome, together with whoever is accountable for the information and the risk involved. In a larger organization that may be a department leader working with IT, privacy, legal, or HR. In a small business, it is often the owner. In a nonprofit, it is usually the executive director or a designated leader, with the board involved in policy-level decisions. Whatever the structure, write down who can say yes and who can say stop.
When does AI-generated work need human review?
Whenever the output will be shared outside the team, relied on as fact, or used in a decision that affects a person. That includes hiring and employment decisions, customer and client communications, donor appeals, financial figures, and anything with legal or safety implications. Review means more than proofreading. The reviewer checks accuracy, fairness, tone, and fit for the audience, and should be named before the work begins.
Does an organization need a different AI policy for HR, operations, and fundraising?
Usually not a separate policy, but each function does need its own guidance. One organization-wide policy can set the core rules: approved tools, prohibited information, review requirements, and decision rights. Each function then needs examples that fit its work, because HR handles candidate and employee information, operations handles customer records, and fundraising handles donor and client stories. The scenarios above show how the same questions apply differently in each.
How do small businesses and nonprofits start without a dedicated AI governance team?
Start with one page and one owner. List the AI tools people already use, the tasks they use them for, and the information that must stay out. Name the person who approves new uses. Then test one real use case against the five questions in this guide. Resources such as the NIST AI Risk Management Framework can inform the work as it matures, but a small organization does not need a full program to make its first decision well. For ongoing peer support as tools and rules change, the AI Governance CoLab is a community for leaders working through these decisions together.
Choose Your Free AI Use Policy Workshop
The core training is the same, but each registration page speaks to a different workplace context. Choose the version that best fits your role.
Free 37 minutes, on demand AI Decision Guide included
HR & Talent Leaders
For HR, talent, L&D, operations, and organizational leaders shaping responsible AI decisions.
Access the free HR & organizational workshop
Small Business Owners & Managers
For small teams that need practical AI use rules without a large legal or compliance department.
Access the free small-business workshop
Nonprofit Leaders & Teams
For executive directors, boards, staff, and program leaders protecting mission-related information and trust.
Access the free nonprofit workshop
About Margaret Spence and Inclusion Learning Lab
Margaret Spence is the founder of Inclusion Learning Lab, a 27-year-old firm working across leadership development, workforce readiness, and AI governance at work. Before founding the firm, she was an insurance risk executive. That background shapes how she approaches workplace AI: as a question of decision rights, accountability, and exposure, not only technology.
She is the author of Leadership Self-Transformation and the forthcoming When AI Breaks the Law, a book on AI governance for talent leaders. Read Margaret's full bio.
Sources and Further Reading
- NIST AI Risk Management Framework (AI RMF 1.0)Voluntary U.S. framework for identifying and managing AI risk. Useful for organizations formalizing review and accountability.
- NIST AI 600-1: Generative AI ProfileCompanion to the AI RMF focused on risks specific to generative AI tools, including data privacy and information integrity.
- FTC: Protecting Personal Information, A Guide for BusinessPlain-language principles for collecting, keeping, and limiting personal information. Relevant to Case B and the data questions above.
- U.S. Small Business Administration: Strengthen Your CybersecurityBaseline guidance on protecting business and customer data for small companies.
From the AI Governance for HR Newsletter by Margaret Spence
- IT Owns the Technology, HR Owns the Liability: Convincing HR to Embrace AI GovernanceWhy HR should lead governance of talent systems while IT keeps managing the infrastructure and security behind them.
- The 12 AI Governance Skills HR Must Master in 2026The full roadmap of skills HR leaders need to manage AI risk in talent decisions, from vendor oversight to bias auditing.
- Understanding How AI Is Trained, What It Learns, and Why It Matters for Your OrganizationA plain-language look at how training data can teach AI tools to repeat past workplace bias, with a risk assessment checklist.
Choose the free AI Use Policy workshop for your workplace.
See the three workshopsScenarios in this guide are illustrative composites. Content is educational and not legal advice. Last reviewed .