An employee preparing a report needs an answer before uploading the file: is this tool approved for this information? A policy that says only to use AI responsibly leaves the employee to make a procurement, privacy, and security decision alone.
May this tool receive this work?
A useful policy gives staff an approved route and a concrete way to resolve uncertainty.
A useful policy is short enough to consult and specific enough to guide a real task. It should explain the approved route, the boundaries, and who can answer an uncertain question. It also needs an owner who can keep those answers current.
Name what is approved
Identify the permitted products, organizational accounts, and uses. Approval for drafting public material should not imply approval for reviewing personnel records or connecting a mailbox. Distinguish a browser chat from an integration that can search files or take actions.
Specify what staff may enter and which material requires additional review. Use examples from the organization's work, with test information for training. The AI governance guide helps connect those rules with authorization, account management, and information handling.
NIST's AI RMF Playbook provides voluntary risk management suggestions that organizations can tailor. It is a resource for building a proportionate process, rather than a requirement to adopt every suggested activity.
Define review that means something
Decide who checks the output and what they must check. A proposed communication may need source verification and an editorial review. A spreadsheet analysis may need a check of the input, assumptions, formulas, and result. Someone with suitable authority must approve consequential decisions through the established process.
Make clear that staff remain responsible for the work they submit. Asking another AI tool whether an answer is correct does not replace checking an authoritative record or having a qualified person review it.
Consider records deliberately. Keep enough evidence to explain significant decisions and reproduce important work where appropriate. Do not automatically copy every prompt into an unrestricted log. Prompts and outputs can contain information that needs its own access and retention controls, covered in data governance.
Give exceptions a route and an end
Staff will find legitimate uses that the original policy did not anticipate. Provide a request process that asks for the purpose, proposed information, product, connections, and person responsible. A time-limited pilot is often a better basis for a decision than a permanent blanket approval.
Tie the approval to procurement and change control. If the tool needs application permissions, have those reviewed before consent is granted. Document removal and export arrangements before the pilot becomes part of a critical workflow.
Include a reporting route for accidental uploads, unexpected access, and harmful or inaccurate output. Staff should be encouraged to report promptly so the right people can act. Then review whether the rules, training, or technical controls need to change.
RDA's aim is a process the department can operate after the policy meeting ends. A manager should be able to explain the permitted use, an employee should know when to stop and ask, and IT should know what it has been authorized to support.