AI Use Policy & Inventory Pack

Somewhere in your organisation, right now, someone is pasting something into an AI tool you have never heard of. The productivity is real. So is the client data leaving through an unapproved service with unknown retention, and the customer questionnaires that now ask directly how you govern AI use.

This pack is the proportionate answer. The policy is short enough to be read and firm where it must be: approved tools listed, confidential and personal data kept out of unapproved ones, human review before AI output reaches clients, and honesty about use where it matters. It bans what needs banning without pretending the technology away, which is why staff will follow it.

The inventory does the governing. List the tools in actual use, including the unofficial ones surfaced from browsing the single sign-on and billing records. For each, record what data it touches, and make one of three decisions: approve, restrict or replace, with the decision and its owner logged. That decision log is what turns "we have an AI policy" into evidence. Publish the policy, point staff at the approved list, and review quarterly as tools change. Brandable copies are included, so the policy you publish is yours from day one.