AI policy examples: public guidelines and worked company policies

What can you learn from other organisations' AI policies?

Other organisations' AI policies are most useful for their structure and wording, not as rules to copy. Their tools, contracts and obligations are not yours. Read an example for how it turns a principle into an instruction, then write your own version for your own workflows.

The public examples below are described from their published documents as checked on 16 October 2026. The company examples are fictional and written for this page; they show the shape of a finished policy, not a recommendation for any real business. None of this is legal advice.

What does the City of Boston's generative AI guidance say?

The City of Boston published interim guidelines for staff on using generative AI in May 2023, version 1.1, applying to city agencies and departments other than Boston Public Schools. It is a short document that encourages responsible experimentation while setting three core rules.

First, fact-check and review all AI-generated content, especially for public communication or decision-making, looking for inaccurate information and bias. Second, disclose that AI was used, including the type and version of model, with a sample credit line: "This description was generated by ChatGPT 3.5 and edited by" the author. Third, do not share sensitive or private information in prompts; the plain test given is that if you would not share it with other people or put the prompt in a public place, leave it out.

What a small business can borrow: the principle that the person using a tool remains responsible for its output, which Boston illustrates with autocorrect, and the habit of pairing each rule with a short reason. What it may not need: mandatory public disclosure on every piece of text, which suits a public body more than an agency writing client drafts.

What does the UK government's AI Playbook include?

The UK government's AI Playbook, published by the Government Digital Service on 10 February 2025, expands on its January 2024 Generative AI Framework and sets out ten principles for civil servants. They include knowing what AI is and its limitations, using AI lawfully, ethically and responsibly, using it securely, having meaningful human control at the right stages, using the right tool for the job and using the principles alongside your organisation's policies.

It is far longer than a small company needs, and much of it concerns buying and building AI systems. The useful part for a small business is the principle list as a checklist: if your policy has nothing that corresponds to limitations, security, human control or using the right tool, it probably has a gap.

What does an AI policy look like for a small agency?

Example one is a fictional 12-person content agency, Brightwater Words. It writes blog posts and newsletters for clients, uses a business workspace of a chat assistant and has no in-house legal team. Its policy is one page.

"1. Owner: [founder name]; backup [senior editor name]. 2. Tools: use only the Brightwater business workspace of [assistant], signed in with your company account. 3. Information: public material and our own drafts are fine. Client briefs and drafts are fine only for clients marked 'AI allowed' in the client list. Never paste client analytics, contracts or anything marked confidential. 4. Checking: every fact, figure, quote and link in client copy is checked against a source you opened. Delete anything you cannot confirm. 5. Disclosure: tell your editor when AI produced a substantial part of a draft; follow each client's AI instruction. 6. Questions or mistakes: ask or tell [founder] the same day. 7. Review: every six months."

Why it works: it fits on a page, it names people, and the client list does the hard work of recording which clients have agreed to AI use.

What does an AI policy look like for an accounting practice?

Example two is a fictional 35-person accounting practice, Ashby and Cole. It handles client financial records and personal data, so its policy is stricter on information and adds a rule about professional judgement.

"1. Owner: practice manager [name]; data protection questions to [name]. 2. Tools: [assistant] business workspace and the AI features in our practice software listed in the register. No other tools. 3. Information: no client financial records, tax identifiers, bank details or personal data in any general-purpose assistant. Practice software AI features may be used on client data only for the tasks listed in the register. 4. Professional judgement: AI may help draft explanations and summarise guidance, but advice to a client is formed and signed off by a qualified member of staff who has checked the source rules. 5. Figures: any number in an AI-assisted document is recalculated from the source data before it is sent. 6. Incidents: follow the existing data incident procedure. 7. Review: annually and when software terms change."

Why it works: it separates the general assistant from tools built into software the firm already trusts with client data, and it keeps professional advice explicitly with people.

What does an AI policy look like for a software company?

Example three is a fictional 90-person software company, Larkspur Cloud, with engineering, sales and support teams. Its policy has a short company-wide section and a page of team-specific rules.

Company-wide: "Use only tools in the register with your company account. Never enter secrets, credentials or customer data into any AI tool unless the register approves that workflow. You are responsible for what you ship or send. Report mistakes to [security lead] the same day."

Engineering: "The approved coding assistant may be used on company repositories. Generated code goes through normal review and tests. Do not paste production logs containing personal data. Check the licence of any substantial generated snippet that looks copied." Sales: "Do not put prospect contact lists into an assistant. Do not send AI-written claims about product performance or customer results without checking them with product marketing." Support: "Drafted replies are read and edited by the agent before sending. Remove account and payment details before using an assistant."

Why it works: one set of shared rules, then the specific risks of each team written in that team's language.

How do these examples differ, and why?

The examples differ mainly in how strictly they treat information, because that is where their risks differ. The agency's main risk is a client's confidential plan leaking or an invented claim being published; the accounting practice's is client financial and personal data; the software company's is secrets and customer data in code and logs.

Which example clauses are worth adapting?

These clauses recur in good employee AI policies because each one turns a principle into an action. Adapt the wording and fill in your names and tools; the template guide has the full structure.

What do weak AI policy examples get wrong?

Weak examples are usually either vague or unrealistic. Vague ones say "use AI responsibly" and "protect confidential data" without saying which tool or which data, so nobody can act on them. Unrealistic ones ban all AI use while the office suite already has AI features switched on, which teaches people to ignore the policy.

Other common problems: no named owner, so questions go nowhere; no review date, so the tool list goes stale; and no training, so people sign a document they cannot apply. Tosheo.ai is being built for the practice step, with planned role-based lessons that end in a hands-on task graded against a visible rubric. It does not write your policy, and none of the fictional companies here are customers.

Sources and scope

City of Boston, Interim Guidelines for Using Generative AI, version 1.1, 18 May 2023 ↗

GOV.UK, AI Playbook for the UK Government, 10 February 2025 ↗