vaultfish
Check your data

Write the AI rules before someone pastes the customer list into a chatbot.

Seven questions, one policy. Built for owners who keep getting asked for one.

Takes about 2 minutes

Build your policy

Staff can use 2 tools freely, must ask about 5 data types, and never paste 3.

Question 1 of 7

How big is the company, and where does it work?
People at the company
Where people work

Can we license our records?

Case by case

  • Leave out personal-data categories
  • Leave out anything customer contracts forbid
  • Leave out legal and privileged material
  • Written license only

Not sure whether your records are worth licensing? Check them

Reading styleSame facts, two voices.
2 pages

Company AI use policy

Plain words edition

1. Purpose

Who the rules cover

AI tools can save time. They can also leak private information when someone pastes in the wrong thing. This policy says which tools to use, what to share with them and who to ask when you are unsure. It covers everyone who works for the Company.

Questions go straight to the Owner or CEO. A short message is fine.

The rules are the same in the office, at home and on the road. Use company accounts, not personal ones.

Local law may add rules on top of these.

2. Approved tools

The short list staff can use today

These AI tools are approved for work: ChatGPT and Claude.

Sign in with your work account. Do not use a personal account for company work.

A tool that is not on the list is off limits for company data, even a free one.

Want a new tool? Send the Owner or CEO the tool name, what you would use it for and what kind of data it would see.

3. Data rules

The traffic light, one lane per data type

Think of a traffic light. Green is fine in an approved tool. Yellow means ask the Owner or CEO first. Red means never paste it in.

Green: fine in approved tools

  • Marketing drafts (posts, emails and ads before they go out)
  • Public information (website text, published reports, press releases)

Yellow: ask first

  • Customer personal details (names, emails, phone numbers, addresses)
  • Source code (code, build scripts, system diagrams)
  • Financial results and plans (revenue, forecasts, budgets)
  • Contracts (customer, vendor and partner agreements)
  • Support tickets (customer questions and chat logs)

Red: never paste

  • Employee details (pay, reviews, health notes, home addresses)
  • Health or financial regulated data (patient records, account numbers, card data)
  • Board and legal documents (board papers, legal advice, case files)

Passwords, keys and login codes are always Red.

4. Check the output

A person reads it before it goes out

AI gets things wrong and sounds sure while it does. The person who used the tool checks every fact, number, name and quote. Their manager also reads anything that leaves the company or affects a customer, an employee or money.

Nothing an AI wrote goes to a customer, a regulator or the public until a person has read it.

5. Customer and vendor promisesTo do

Promises we already made

We have not yet checked whether our customer and vendor contracts limit AI use. Until we have, ask the Owner or CEO before you use any customer or vendor material in an AI tool.

Drafting note, not printed. To do: a lawyer reviews customer and vendor terms for AI limits within 30 days of the effective date.

6. Report a mistake

What to do when something slips

If you paste something Red, or send AI output that turns out to be wrong, tell the Owner or CEO the same day. Say what happened and which tool it was. Honest, quick reports get thanks, not blame.

Do not delete anything first. The Owner or CEO decides the next step.

7. Company records and AI licensingCase by case

Who may license company records, and how

AI developers sometimes pay to license company records. This section says whether we do that and who decides.

We may license some records to an AI developer, one deal at a time. An owner or officer of the company must approve each deal in writing before anyone shares anything. Staff do not offer or share records on their own.

Every deal follows these rules:

  • Leave out whole categories that hold personal details, such as HR, payroll, health, union and call-recording records. Do not rely on scrubbing names out afterward.
  • Leave out anything a customer or vendor contract does not let us share.
  • Leave out legal advice and other privileged material.
  • Put every license in a written agreement before any records change hands.

Records retention. Keep business records for the periods your lawyer and accountant set. Do not delete records that a buyer or a regulator may ask for without asking first.

8. Review and sign-off

One owner, one review date

The Owner or CEO owns this policy. We review it every year, and sooner if the tools or the law change.

Policy owner: the Owner or CEO

Signature: ______________________ Effective date: ______________

Have your lawyer look at this before anyone signs it. They like having something to mark up, and it costs less than starting from a blank page.

Made with the AI policy generator at vaultfish.com. Not legal advice.

See the traffic lights as a list
Each kind of data and its lane
DataLane
Customer personal detailsYellow
Employee detailsRed
Source codeYellow
Financial results and plansYellow
ContractsYellow
Health or financial regulated dataRed
Board and legal documentsRed
Support ticketsYellow
Marketing draftsGreen
Public informationGreen

Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral

What this means

  • Your policy gives staff a yes list, an ask list and a never list.
  • The records section says who may license company records, so nobody makes that call alone.
  • Let your lawyer mark it up, which costs less than starting from a blank page.
Talk to a human

What an AI policy needs to say

An AI policy is a short page that tells staff how to use tools like ChatGPT and Claude at work. It does three jobs. It names the tools people may use. It sorts company data into lanes, so nobody has to guess what is safe to paste. And it says who reads the output before it goes to a customer.

The ten lanes in the tool start with sensible presets, so you only fix what is wrong for your company. Green data is fine in an approved tool. Yellow data needs a quick yes. Red data stays out of every chatbot.

Three lanes for company dataGreen data is fine in approved tools. Yellow data needs a yes first. Red data never goes into a chatbot.Three lanes decide what goes inGreenFine in approved tools. Public text, early marketing drafts.YellowAsk first. Contracts, code, customer details.RedNever paste. Health records, board papers, passwords.Three lanes for company dataGreen data is fine in approved tools. Yellow data needs a yes first. Red data never goes into a chatbot.Three lanes decidewhat goes inGreenFine in approved tools. Publictext, early marketing drafts.YellowAsk first. Contracts, code,customer details.RedNever paste. Health records,board papers, passwords.
Ten kinds of data, three lanes, one page.

Most templates stop there. This one adds a section on company records. AI labs sometimes pay to license years of business records. Someone at your company should decide ahead of time whether that is allowed, who signs off and which rules apply. Licensing works like renting out a room. The buyer uses it for a while under your rules, and you keep the house.

One more habit helps. Do not delete old records until you know what a buyer or a regulator may ask for. The policy carries a short records retention line for that reason.

Questions people ask

What should an AI policy include?

A short list of approved tools, rules for what staff may paste into them, who checks the output, a note on customer and vendor promises, a way to report a mistake and one named owner. Our generator adds a section on company records.

Is the AI policy template free?

Yes. View it on screen, print it, copy it, or save it as a markdown or Word file. We only ask for an email if you want a copy sent to you.

Can I use the AI policy template as an AI acceptable use policy?

Yes. It works as a generative AI policy template and an AI acceptable use policy. Both cover the same ground: tools, data, review and reporting.

Why does an AI policy talk about licensing records?

AI labs sometimes pay to license company records. If someone at your company gets that call, the policy says who decides, what rules apply and what happens to old records meanwhile.

Does my company name go anywhere?

No. It stays in your browser and your downloaded file. The share link carries your choices and leaves the name out.

Is the AI policy template legal advice?

No. Have your lawyer review the policy before anyone signs it, since lawyers like having something to mark up.

Related tools

Company data mapDraw where your records live. Takes about as long as a coffee.Data room checklistThe sale needs a data room. Add one drawer and it doubles as a licensing package.Bring your CPA or CFO inRun this policy with them, and ask for the records line in your yearly review.