Draft AI Guidance for Your Staff
One page telling your team which AI tools are approved, how to sign in, what information may go in and what must not. The document that unblocks everyone.
The prompt
--- SCOPE --- SITUATION: I run or manage a [DESCRIBE THE BUSINESS, e.g. eight-person accountancy practice, HR consultancy, engineering firm] and my staff have access to AI tools but are barely using them. Nobody has written down what they are allowed to do, so people are avoiding the tools in case they get it wrong. Here is what we have: - AI tools available to staff: [LIST THE TOOLS, e.g. Microsoft 365 Copilot, ChatGPT free tier, Claude] - How staff sign in: [WORK ACCOUNT, PERSONAL ACCOUNT, OR NOT SURE] - Who pays and how: [INCLUDED IN OUR SUBSCRIPTION / PAID ADD-ON / STAFF USING FREE TIERS] - The most sensitive information we handle: [DESCRIBE IT, e.g. client financial records, payroll data, employee case files] - Any rule we already know we want: [E.G. NOTHING CLIENT-IDENTIFIABLE, OR LEAVE BLANK] CHALLENGE: I need a single page my staff can actually read and act on. Not a legal document, not a policy nobody opens. Something that gives a cautious person the confidence to use a tool we already pay for. EVALUATE: Write me that page. Include: 1. WHAT YOU MAY USE. Name each approved tool, say exactly how to sign in to it correctly, and state plainly whether using it costs the business anything. Call out where signing in with the wrong account changes the protections that apply. 2. WHAT YOU MAY PUT IN. Concrete examples of information that is fine to use, drawn from the actual work this business does. Give examples, not categories. 3. WHAT MUST NEVER GO IN. The same, in reverse. Be specific enough that someone can check their own case against it without asking. 4. THE GREY AREA. What to do when it is not clear. Name a person to ask, and give one simple test someone can apply themselves in the meantime. 5. WHAT YOU STILL OWN. A short section making clear that the person using the tool is responsible for checking the output before it reaches a client, and what checking actually means here. 6. WHAT THIS MAKES POSSIBLE. Three or four real jobs in this business that staff could reasonably use these tools for tomorrow. Practical, everyday, unglamorous. Then, separately from the page itself, give me a short review note: the decisions in this draft where you had to make an assumption about our risk appetite, and the questions I should settle before I circulate it. Write the page in plain English, in the second person, addressed to staff. Short sentences. No jargon. It should fit on one side of A4.
What you get back
- A one-page document written for your staff, naming the approved tools, how to sign in correctly, and whether using them costs the business anything
- Specific examples of what may and may not go into a tool, drawn from the work your business actually does, plus a test people can apply themselves in the grey area
- A separate review note listing the assumptions the draft made about your risk appetite, so you can settle those before it goes out
How to use it
Fill in the five bracketed fields honestly, especially the sensitive-information one. The quality of what comes back depends almost entirely on how specific you are there. If you are not sure how staff are signing in, put “not sure” rather than guessing, and the draft will tell you why it matters and how to check.
Read the review note before you circulate the page. It surfaces the decisions the draft made on your behalf, and those are the ones a partner or director needs to own rather than inherit.