Considerations for AI Policy Development

10 Things to Consider when Crafting an AI Policy

---

1. Identify Your Organization’s AI Strategy:

• Establish the purpose of your organization’s use of AI. What AI are you using and what does AI accomplish?

2. Identify the Policy Scope:

• Will this policy apply only to employees, or also to vendors, independent contractors, temporary staff, clients, etc.?

3. Authorize Technology:

• Define what AI the company will authorize and/or prohibit. Will the organization use AI that is commercially available, or use proprietary technology? Will there be an approval process employees need to follow to gain approval before using new technology?

4. Verify State Laws and Legal Requirements:

• Determine whether any current or pending State and Federal laws may influence your organization’s use of AI. Remember that laws may not be specific to AI but could instead cover data, like protected health information (PHI) or personally identifiable information (PII). Are there data tracking or bias testing requirements? Are disclosures required and under what circumstances? Special consideration is needed for employers operating in multiple states. Employers should also be aware of record retention laws in their state(s) and industry, and whether AI records and data are subject to them. Ensure the policy addresses copyright or trademark infringement and intellectual property.

5. Define Employee Use:

• Outline how employees will be permitted to use AI, and whether they or your organization will need to disclose its use either under law or organization policy. Are any uses of AI expressly prohibited by the company? Will employees need to be trained to use AI? Will all employees have access to the same AI, or will it depend on their job title, job level, department, or otherwise? Will employees be using AI on company equipment versus personal equipment? Will your policy address employees using AI for professional vs personal use?

6. Ensure a Human is in the Loop:

• The policy should dictate that AI cannot be the sole decision-maker for critical business functions, and that employees are responsible for verifying all AI-generated output before acting on it or sending it to a client. Does the policy state that the human user is responsible for ensuring the AI’s output is not biased against protected classes? Explicitly state that the employee is the final editor or decision maker.

7. Ensure Data Privacy and Confidentiality:

• Identify privacy and confidentiality considerations that will influence employee use of AI. If working with sensitive or client-data, the AI being used should be a “closed loop”. Users should refrain from disclosing confidential information to publicly available software, including providing client, company, or employee-specific information or proprietary data to platforms such as ChatGPT, CoPilot, Gemini, or others that may “learn” from or disseminate the information.

8. Assess for Handbook and Policy Alignment:

• Review your handbook or policy manual and determine if any existing policies may need updates to align with the new AI policy. Are there any policies within the handbook that influence employee behavior under this policy? Examples may include your Standards or Conduct, Use of Business Equipment and Information Systems, and Harassment and Discrimination Prevention policies.

9. Include Language for Policy Violations:

• State that violation of this policy may result in disciplinary action, up to and including termination of employment.

10. Establish Reporting Obligations:

• Describe the procedure, and to whom, individuals should follow to report any concerns, incidents, or violations of the use of AI technologies.