Your Team's AI Policy Should Fit on One Page. Here Is the Page.

Here is the page. Copy it, fill in the brackets, and pin it in the team chat where people will actually see it. Under the page, each line has a note on why it is there, what goes wrong without it, and the evidence behind it. If your current policy runs to a dozen pages, keep that version for legal and give the team this one.

The policy

Why each line is there

Line 1: what never goes into a tool

This is the line I would keep if I could only keep one. The University of Melbourne and KPMG study surveyed more than 48,000 people in 47 countries between November 2024 and January 2025. Almost half of employees admitted using AI in ways that contravene company policies, and the release names uploading sensitive company information into free public tools such as ChatGPT as one of those ways.

Without this line, people make the call themselves, one prompt at a time, usually under a deadline. I would name categories rather than write “be careful with data”, because a category is something you can check before you paste. Six categories is about as many as anyone will remember.

Line 2: approved tools, company accounts

Your team is already using AI. The live question is whose account it runs through. In Microsoft and LinkedIn’s 2024 Work Trend Index, as reported by Fortune, 75% of knowledge workers across 31 countries used generative AI at work, and 78% of those users brought their own tools. A personal login puts the settings, the history and whatever was pasted in outside anything the company controls, including after that person leaves.

Keep the approved list short and put a date next to it. A list nobody maintains goes stale, and once it is stale, people stop checking it.

Line 3: a named person signs off

The same Melbourne study found 66% of employees rely on AI output without evaluating its accuracy, and 56% say they have made mistakes in their work because of AI.

“Someone should review it” means nobody does. A name means one person reads the whole piece and answers for it if it is wrong. I put ownership of every fact on that person deliberately. When accuracy belongs to everyone who touched a draft, a wrong number can pass four people and still go out.

Line 4: check the source

Line 3 says who checks. Line 4 says what checking means. An AI tool can produce a statistic or a quote that does not exist, and it reads exactly like one that does. A marketing team publishes numbers for a living, so this is where the damage lands.

“If you cannot find the source, cut it” is the rule on this page I care about most. It takes a minute to follow, and it prevents the most embarrassing correction a team can issue.

Line 5: disclosure

The Melbourne study found 57% of employees hide their use of AI and present AI-generated work as their own. In a marketing team, that habit reaches clients and audiences too.

I kept this line conditional on purpose. Disclosure expectations differ by client, by platform and by market, and a blanket rule either labels everything or gets ignored. If you sell into Europe, the obligations are more specific, and I have covered what the EU AI Act means for Indian teams separately.

Lines 6 and 7: who to ask, and owning mistakes

These two lines make the other five work. If the policy only lists rules, people will hide the times they break one. With 57% already hiding their AI use, I would expect a policy that punishes honest mistakes to push more of it out of sight.

Name an actual person and a channel they check. “Reach out to legal” is something nobody does at seven in the evening before a launch. And say plainly that reporting a mistake is safe, because the mistakes you hear about the same day are the cheap ones.

This page covers the rules. Whether the tools are earning their place is a separate question, and I have written about how to track whether AI is working in marketing and the four pitfalls that sink AI projects in a business. None of those four is about rules.

The Indian legal context, in plain language

I am not a lawyer, and nothing here is legal advice. But if your team touches customer data, India’s data protection rules are the reason line 1 deserves to be taken seriously.

According to the Press Information Bureau backgrounder, the government notified the Digital Personal Data Protection Rules on 14 November 2025, with an eighteen-month period for phased compliance. Under the Act, the highest penalty, up to ₹250 crore, applies to a data fiduciary’s failure to maintain reasonable security safeguards. Failing to notify the Board or affected people of a personal data breach, and violating obligations relating to children, can each draw up to ₹200 crore. Other violations can draw up to ₹50 crore. Every data fiduciary has to issue a separate consent notice that is clear and explains the specific purpose for which personal data is collected and used, and requests from people to access, correct or erase their data have to be answered within ninety days.

Two things follow for a marketing team. First, the responsibility sits with the data fiduciary, the organisation that decides why and how personal data is used. So this is a company decision before it is a team habit, and your policy should match whatever your company has already committed to. Second, the customer data your team holds was collected for a purpose that was stated in a notice. Before anyone pastes it into a tool, I would want counsel to confirm that the use fits the purpose the customer agreed to. Line 1 exists so that question gets asked before the paste.

One test tells you whether the page is working. If someone on your team pasted a customer list into a public tool tomorrow, would they know from this page that they had broken a rule, and who to tell that same day? If the answer is yes, the page is short enough and clear enough. If it is no, I would cut the page down before adding a single line to it. Reply with how many pages your current AI policy runs to, and whether anyone on your team has read it to the end.