What to do when your organisation has no AI policy: a practical starting point

Most organisations using AI tools today — including newsrooms, NGOs, HR departments and corporate communications teams — have no documented AI use policy. This is not unusual: AI tools became widely adopted faster than governance could follow. An AI use policy does not need to be a legal document. It needs to answer four questions: what AI tools are permitted, for what purposes, with what human oversight, and with what disclosure. This guide covers how to build one from scratch, what the EU AI Act requires, and where most organisations go wrong.

Start with what is already happening

The most common mistake in AI policy development is designing for a hypothetical future state rather than documenting the actual present. Before drafting a word of policy, leadership needs to know what AI use is already happening in the organisation — officially or informally. This requires a process that creates enough psychological safety for team members to report their actual practice. In most organisations, informal AI use exceeds what leadership assumes. People use AI for transcription, translation, research, drafting, summarisation and data analysis. They do so without disclosure because no disclosure norm exists, not because they are hiding wrongdoing. An honest account of current practice is the only reliable basis for a policy that will actually be followed.

The six components of a workable AI use policy

First, permitted tools. Specify which AI tools are approved and which are not. A blanket prohibition is unenforceable and drives use underground; a blanket permission creates legal and quality risk. A tiered approach works: fully approved tools, conditionally approved tools (permitted for specific uses with additional oversight), and prohibited tools.

Second, permitted uses. For each approved tool, specify what it can be used for. Using AI to draft client-facing content requires either explicit prohibition or a verification requirement rigorous enough that the efficiency gain disappears. Using AI for research, summarisation, data processing and structural drafting — with mandatory human verification before any AI-derived claim reaches a client or the public — is where most organisations land.

Third, the verification requirement. For every AI-assisted workflow, specify what human oversight is required before AI-derived content is shared or acted upon. This is both the quality safeguard and the anti-hallucination mechanism.

Fourth, disclosure. Specify when and how AI use is disclosed — to clients, audiences, regulators or the public. The EU AI Act creates minimum transparency obligations for certain AI-generated content. Specific disclosure is more credible than generic: "this document was AI-assisted and verified by [name/function]" tells readers more than a general AI disclaimer.

Fifth, error-flagging. Specify how team members report AI errors and what process follows. A functioning error-flagging process requires psychological safety: people who fear that flagging an AI error implies they were using AI improperly will not report. The policy needs to separate error-flagging (a quality function) from disclosure of AI use (a communications function).

Sixth, accountability. Specify who owns AI governance decisions: who reviews the approved tool list, who handles escalations, and who updates the policy as the regulatory and technological environment changes.

The disclosure question is harder than it looks

Disclosure is where organisational values and competitive pressure collide most directly. The most defensible position is specificity over generality. A general disclaimer tells stakeholders very little. Specific, contextual disclosure — attached to the document, output or communication it concerns — is more useful, more credible and more compliant with emerging transparency norms.

Red lines AI should not cross

Every AI use policy benefits from an explicit list of what AI will not do. Common operational red lines: AI will not generate or invent direct quotes attributed to real people; AI will not be the sole source for a factual claim; AI will not make decisions about whether to publish, distribute or act; AI will not produce synthetic images or audio of real people without their consent; AI will not process confidential client or source material on third-party servers without explicit approval. These red lines should be short, specific and agreed by leadership. The process of agreeing them — which typically surfaces disagreement about edge cases — is itself an important governance exercise.

What comes next

A first-draft AI use policy is not a final policy. The EU AI Act has implementation timelines running through 2026 and 2027. Build in a review schedule — every six months for the first two years, annually thereafter. The goal is not a perfect policy. It is a policy that makes human judgement visible, protects your organisation and the people it serves, and can be updated as the ground shifts beneath it.