AI tools are easy to start with: open a website, type a question, get an answer. That is exactly why every company needs a few rules. Without them, people use private accounts, paste customer data into unknown tools and send texts that nobody has checked. Most of the time, nothing happens — until something does.
This is part 5 of Level 0, the last part of the start level in our AI Work learning path. You will get a traffic light for everyday AI use, seven ground rules with the reasons behind them, extra rules for AI that talks to customers and a one-page policy template for your team. This article gives general guidance, not legal advice. Involve your data protection officer or legal team before your company adopts a policy.
Why rules come first
When a company has no rules, employees use AI anyway, with their own accounts and their own judgment. This is often called shadow AI. The main risk is not the AI itself, but the data and decisions that leave your control. A well-known example: in 2023, Samsung restricted the use of generative AI tools such as ChatGPT on company devices after employees had uploaded sensitive internal source code to it (Source: Bloomberg, May 2023).
Rules also protect the quality of the work itself. Researchers at BetterUp Labs and the Stanford Social Media Lab have a name for AI output that looks like good work but does not move the task forward: workslop. In their survey of 1,150 full-time US office workers in September 2025, 40% said they had received workslop in the past month, and each case took almost two hours to sort out. Half of the people who received it saw the sender as less creative, capable and reliable afterward (Source: BetterUp Labs and Stanford Social Media Lab, reported by Fortune, September 2025). So the goal is not less AI, but a simple standard: pass on only what you have checked and can explain yourself.
Good rules do not slow people down. They tell everyone which tools they can use right away, and for what. A simple traffic light is a good start:
Seven ground rules
Use approved tools with company accounts. “Approved” means that someone has checked where the data goes, whether the provider may use it to train its models and what the contract says. Our comparison alone lists 46 tools for AI Work. No company can check them all, so a short list of approved tools makes the choice easy.
Keep confidential data out of unapproved tools. This covers personal data about customers and colleagues, contracts, financial figures, passwords and access keys. If you are not sure, leave the detail out or replace it with a placeholder such as “Customer A”. Part 4 explains why every data set needs an owner who decides where it may go.
Check every result before you use it. Check facts, numbers, names, quotes and links, and read for tone. AI makes mistakes that sound convincing. You are responsible for what you send, not the tool.
Be open about AI use. Tell customers when they are talking to a bot, and label AI-generated images, videos and voices where people could mistake them for real ones. In the EU, the AI Act requires that people are informed when they interact with an AI system, unless this is obvious, and that deepfakes are labeled as such (Source: EU AI Act, Article 50, eur-lex.europa.eu).
Respect copyright and other people’s rights. Do not upload material you have no rights to, such as paid studies or a client’s documents, into tools that may store it. Check generated images and texts for brands, logos and real people before you publish them. Also note that you may not own purely AI-generated content. The US Copyright Office concluded in 2025 that prompts alone are not enough for copyright protection. Protection covers only what a person contributes (Source: U.S. Copyright Office, Copyright and Artificial Intelligence, Part 2, 2025, copyright.gov).
Let people decide about people. Hiring, performance reviews, credit and individual prices are decisions with real consequences. AI may prepare them, but a person decides. In the EU, the GDPR gives people the right not to be subject to decisions based solely on automated processing that significantly affect them, with some exceptions (Source: GDPR, Article 22, eur-lex.europa.eu).
Give every AI use an owner, because the company is accountable. A chatbot’s mistakes are the company’s mistakes. In 2024, a tribunal in British Columbia, Canada, ordered Air Canada to compensate a customer after its website chatbot had given him wrong information about bereavement fares. The tribunal rejected the airline’s argument that the chatbot was responsible for its own actions (Source: Moffatt v. Air Canada, 2024 BCCRT 149). Name an owner for each AI use, and make it easy to report errors and data slips without blame.
Before you paste anything into an AI tool, three quick questions put rules 1 and 2 into practice:
Extra rules for AI that talks to customers
When AI talks to customers directly, as a chatbot, a phone agent or an email assistant that sends replies on its own, its mistakes reach customers before anyone can catch them. Six extra rules apply:
- Say that it is AI, right at the start.
- Make a person reachable, with an easy way to switch to a human.
- Answer only from approved, current content, such as your help center.
- Make no promises outside your policy: no discounts, refunds, or legal or medical advice unless this is explicitly allowed.
- Review conversations regularly by checking samples, while respecting privacy.
- Name an owner who can change the bot or switch it off.
The level of AI help matters too. A bot that only answers questions works like an assistant. A bot that can issue refunds or change orders acts like an agent and needs approvals and limits; part 3 explains the difference. Here are examples of customer-facing AI tools from our comparison:
Short descriptions from our tool comparison, based on the vendors' information — not tested by ABXK.
A one-page AI policy for your team
A policy does not have to be long to work. One page that people actually read beats a long document that nobody opens. Use this template and replace the example sentences with your own:
| Section | What it answers | Example sentence |
|---|---|---|
| Purpose | Why do we use AI? | “We use AI to save time on routine work, without risk to customers or data.” |
| Approved tools | Which tools, with which accounts? | “Approved: our chat assistant with a company account and our meeting assistant for internal meetings.” |
| Data | What may go into which tool? | “No customer or staff data in tools outside the approved list.” |
| Checking | Who checks what before use? | “A person reads every text before it goes to a customer.” |
| Disclosure | When do we say that AI was used? | “Our chatbot says that it is an AI and offers a person.” |
| Rights | What about copyright and brands? | “Generated images are published only after a rights check by marketing.” |
| Accountability | Who owns each AI use, and where do we report errors? | “Every AI use has a named owner. Report errors to the team lead.” |
| Review | When do we update the policy? | “We review this policy every six months.” |
As your company uses AI more widely, this page grows into a governance process with a list of all AI uses, risk levels and approvals. Level 4 covers AI governance for business teams, and our AI Security section explains the security side in depth.