Generative AI Policy: A Starter Guide for Teams

A generative AI policy is a narrower cousin of a general AI usage policy, focused specifically on tools that create or transform content: writing assistants, image generators, code completers, and audio or video tools. It's worth treating separately because the risk profile is different from ordinary software. Your inputs can train a model, your outputs can be confidently wrong, and who owns the result isn't always obvious. This guide covers what to include, how strict to be, and how to keep the policy useful as the tool list keeps changing.

What makes generative AI different from ordinary software

A spreadsheet doesn't learn from what you type into it. Many consumer AI tools do, at least by default, which means a prompt containing confidential information can end up shaping a model that other people query later. Add to that the accuracy problem - generative tools produce plausible-sounding output that's sometimes simply wrong - and the attribution problem - it's often unclear whether AI-generated text, code or images can be used commercially without restriction - and you have three risks a normal software policy was never built to address. A licence agreement for accounting software doesn't need a clause about the software learning from your invoices; a generative AI tool genuinely might, and that single difference is why a bolted-on paragraph in the general IT policy usually isn't enough.

Which tools actually need naming?

Obvious candidates: ChatGPT, Claude, Gemini, Copilot, Midjourney, Adobe Firefly, Grammarly. Less obvious, and often bigger in practice: the AI features quietly built into Canva, Notion, Slack, Zoom and your CRM. Rather than trying to name every tool - a losing battle, since new ones ship monthly - set a principle: 'any tool that generates, rewrites or summarises content using AI falls under this policy, whether standalone or built into other software.' That single sentence future-proofs the policy far better than any list, however long you make it today.

The three rules every generative AI policy needs

Data: don't enter confidential, personal or client data into a tool that isn't on the approved list. Accuracy: treat AI output as a first draft - a person with relevant knowledge reviews it before it's finalised or sent. Transparency: disclose AI involvement where law, contract or plain honesty requires it, particularly in legal filings, regulatory submissions and client reports. Most policy failures trace back to skipping one of these three, not to some more exotic gap.

A worked example: a design team piloting two new tools

A 12-person product design team at a mid-sized retailer we've seen go through this started trialling Midjourney for concept art and GitHub Copilot for internal tooling in the same month, with no policy covering either. The fix wasn't complicated: a line saying Midjourney outputs need a licensing check before any commercial use, and a line saying Copilot suggestions get reviewed like any other pull request, no exceptions for 'it's just internal.' Two sentences, added to an existing one-page policy, closed most of the gap.

Mistakes worth avoiding

Naming a tool instead of a category is the most common one - a policy that says 'ChatGPT is approved' says nothing about Claude, Gemini or whatever launches next quarter. Treating accuracy as the vendor's problem is another: no generative tool guarantees correct output, so the human-review step has to sit with your team, not the API terms. And forgetting that generative AI now sits inside other software is a third - a policy that only covers standalone apps misses the summarise button already live in half your existing stack.

Image and code generators need their own line

A general data rule doesn't cover copyright. Image generators like Midjourney and Firefly raise questions about who owns the output and whether it can be used commercially without further checks - treat AI-generated images as needing a licence check before they go into a paid campaign or product. Code assistants like GitHub Copilot and Cursor raise a different risk: proprietary code sent to a third-party model, and suggested code that may carry licensing terms from its training data. Require human review of AI-suggested code the same way you'd review any other contributor's pull request, and check your chosen tool's settings for whether it can be configured to exclude your private repositories from any wider training set.

How strict should the policy be?

That depends on sector and data sensitivity, not on how new the tool is. A marketing agency working on public-facing creative can afford to be permissive. A law firm handling client documents needs a much stricter data rule, and probably a shorter approved-tools list. Most teams land somewhere in between: generative AI is encouraged for productivity, with specific guardrails tied to specific data types and output uses, rather than a blanket 'ask permission for everything' rule that nobody follows. Write the strictness level down explicitly - 'permissive', 'conditional' or 'restricted' - so reviewers years from now know which stance was intended, not just what the wording happens to say.

Do staff need training as well as a policy?

A document on its own rarely changes behaviour. A short briefing - even fifteen minutes - where someone walks through the data rule and shows the approved-tools list tends to stick better than an email people skim once. It also builds a stronger evidence trail for the EU AI Act's AI-literacy duty than a policy alone, since you can point to a session and a date, not just a document nobody's sure was read. ISO/IEC 42001, published in December 2023 as the first AI management system standard, expects exactly this kind of documented awareness activity from organisations that adopt it, which gives smaller teams a useful benchmark even if formal certification isn't on the table.

Where regulation is heading

Generative AI specifically is drawing regulatory attention beyond general AI governance. The EU AI Act's transparency requirements push toward disclosing AI-generated content in more contexts over time, and Google's own generative AI privacy hub for Workspace shows how seriously even the platform vendors now treat this as a distinct category, separate from ordinary product terms. Writing your policy around principles now means less rework as specific disclosure rules solidify sector by sector.

Write it once, tailored to your tools

Our free policy generator asks about your sector, the tool categories you actually use, and your regulatory context, then outputs a generative AI policy ready to edit and send for team attestation. Check the AI Tool Risk Directory first if you're not sure how a specific tool on your list actually handles data - it's faster than reading each vendor's privacy policy from scratch.