Do I need an AI policy for my employees?

Your employees are probably already using it

In a Pew Research Center survey of 5,010 U.S. workers in September 2025, 21% said at least some of their work is done with AI, up from 16% a year earlier. Among workers with a bachelor’s degree it was 28%.

Most of that use does not start with a company decision. It starts with one person on a free account who found it saves an hour, and it spreads from there. Owners tend to underestimate it, because employees who are unsure whether it is allowed do not mention it.

What goes wrong without one

The risks are ordinary ones, and each has already reached a court or a regulator.

• Customer or employee information pasted into a consumer tool whose terms let the provider keep it or train on it.
• AI-written work sent out unchecked. In Mata v. Avianca (2023), two lawyers were fined $5,000 for filing a brief that cited six cases ChatGPT had invented.
• An AI notetaker recording people on a call who never agreed to it, the claim at the center of the 2025 class action Brewer v. Otter.ai.
• AI used to screen or rank job applicants without the notice some states now require, or with results that fall harder on a protected group.

What a policy changes

A policy turns hundreds of private judgment calls into a few company decisions that everyone can follow and managers can enforce the same way.

• Which tools are approved, on which accounts, and how to ask for a new one.
• Which kinds of information may go into which tools.
• Which work a person must check before it reaches a customer.
• Whether AI may be used in hiring, promotion or discipline, and on what terms.
• Who owns the policy and when it is next reviewed.

How long it needs to be

Two to four pages in plain language is enough for most companies this size. A policy nobody reads protects nobody, so short and specific beats long and general. Each employee should sign that they have read it, and the signatures should be kept with the version they signed.