December 15, 2025 · 5 min read
The AI Use Policy We Actually Wrote for a Client, Not a Template
Every AI use policy template we looked at before writing one for a client was generic enough to be useless, so we scrapped the templates and wrote one from their actual incidents instead.
A client asked for an AI use policy, and the obvious starting point — adapting one of the dozen templates floating around — produced a document that said things like 'use AI responsibly' and 'verify outputs before publishing.' True, unobjectionable, and completely unenforceable, because nobody could point to a specific sentence in it and say whether a given action violated it.
What we did instead
We started from the client's own near-incidents — three specific situations from the previous year where AI use had gone sideways or come close to it: a drafted social post with a fabricated statistic that almost went live, an internal summary that leaked a detail from a confidential document into a shared channel, a team member using a personal AI account for client work with unclear data handling. The policy was built to directly address those three situations, specifically, by name.
A policy built from 'use AI responsibly' is a policy nobody can violate in a way anyone can point to. A policy built from three real incidents is a policy with teeth.
What ended up in the final document
- A specific rule that any AI-sourced statistic or figure requires a named human to confirm the source before publishing — directly tied to the near-miss that nearly shipped.
- An explicit list of approved tools and accounts for client work, closing the personal-account data handling gap.
- A defined, named review step for anything AI-assisted touching external communication, with accountability assigned to a role, not a vague 'the team.'
- A short, plain-language rationale next to each rule explaining the actual incident it addresses, so the policy reads as reasoning, not decree.
The client's team reported the policy actually got referenced in day-to-day work, which almost never happens with the generic version. Specificity tied to a real incident is what makes a policy something people remember and follow, rather than a document everyone signs once and never opens again.