AI use policy The short written rules that tell staff which AI they may use, with what, and how to check it.
Short answer. An AI use policy is a written set of rules that tells staff which AI tools they may use, for which tasks, with what data, and what they must check before relying on the output. It turns an office’s risk decisions into instructions people can follow. CERT-In’s advisory of 26 March 2025 is a useful base: use only AI tools approved and verified by the organisation, avoid online generative AI tools for professional work involving sensitive information, configure and periodically review tools’ access to business data, and fact-check responses instead of relying on AI alone. A workable policy fits on two pages, names an owner, and comes with a list of approved tools and a way to report mistakes. It is not legal advice: check the professional and sector rules that apply to you.
01
Clauses most office policies need
Clause
What it settles
Example wording
Scope
Who and what the policy covers
Applies to partners, staff, interns and contractors using AI for office work, on any device.
Approved tools
The only AI tools allowed for office work
Use only tools on the approved list. Personal AI accounts must not be used for client work.
Data rules
What may go into each tool
Do not enter client, patient or employee personal data into any tool not approved for it.
Checking
A person’s review before use
A named person checks every AI-assisted output that goes to a client, court, patient or regulator.
Disclosure
When AI use is disclosed
Tell clients and publishers where their terms or rules require it.
Records
What is logged and kept
AI use on approved tools is logged and kept for an agreed period.
Incidents
How problems are reported
Report a wrong output or possible data exposure to the policy owner the same day.
Review
When the policy changes
Reviewed every six months, and whenever a tool or a law changes.
02
What CERT-In and NIST add
CERT-In’s earlier advisory of 9 May 2023 on AI language-based applications told users not to submit sensitive information such as login credentials or financial information, and suggested that organisations monitor use and prepare an incident response plan.
NIST’s AI Risk Management Framework asks that legal requirements involving AI are understood and documented (GOVERN 1.1), that roles and responsibilities are clear (GOVERN 2.1) and that staff receive training to do their part (GOVERN 2.2).
03
Mistakes to avoid
A ban with no approved alternative: staff move to personal accounts and the office loses sight of AI use.
Rules nobody can check: without logs, “do not paste client data” cannot be verified.
One rule for all data: a public tender document and a patient record need different handling.
No owner: a policy without a named person to approve tools and answer questions goes stale.
04
Making the policy enforceable
A policy is easier to follow when the approved tool is also the convenient one. On ANVE, for example, cloud models are used only if an administrator adds a provider and their answers are labelled, roles today are administrator and user, and every model call is logged with the user, the app and the model; single sign-on and a policy that blocks confidential data from cloud models are not on ANVE yet (see the /security page). Whatever tool you choose, the policy, approvals and checks remain the office’s responsibility.
05
Questions people ask
Should an office ban ChatGPT?
A ban without an approved alternative tends to push use onto personal accounts. Approving specific tools for specific data, and forbidding the rest, gives staff a safe route.
How long should an AI use policy be?
Short enough to be read and remembered. Keep the policy to principles and put details in the approved-tools list, which changes more often.
Does the policy need to cover client consent?
It should say when client consent or disclosure is needed, which depends on your engagement letters, professional rules and the data involved.
Who approves a new AI tool?
The policy owner, after checking where data goes, whether it is kept or used for training, and who can access it. Record the decision in your AI register.
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
