Five short documents are all most businesses need.

Organization: [Your organization]

Effective: [Month Year]

Approved by: [Name, Role]

Questions: [Name, Role, email]

1. Why this policy exists

We use AI tools to help us work faster and better. This one-page policy sets out

how our people may use them. It is short on purpose. If something here is

unclear, ask [Name] before you use the tool.

2. What you may use AI for

You may use approved AI tools to help with work such as drafting, research,

summarizing, analysis, administrative tasks and preparing content. AI helps you

do the work. It does not do the work for you, and it is never the final word.

3. Which tools you may use

Only these tools are approved for work use:

• [Tool name] - [what it may be used for]
• [Tool name] - [what it may be used for]

If you want to use a different tool for work, ask [Name] first.

4. Confidential information

Do not enter confidential, privileged or sensitive business or client

information into a public or unapproved AI tool. This includes client documents

and data, personal information about individuals, unreleased commercial

information, and anything covered by a confidentiality obligation.

Never enter passwords, security credentials, access keys or similar sensitive

access information into any AI tool.

5. A person reviews the work

Material AI-assisted work is reviewed by a person before it is sent, published

or relied upon outside the organization. The reviewer may change, reject or

disregard the AI output, and is expected to do so where it is wrong, unclear or

unsuitable. Check facts, figures, names, quotations and citations.

6. A person approves important decisions

Important recommendations, advice or decisions informed by AI receive human

approval before action is taken. AI does not make final consequential decisions

about people on its own. A person, not the tool, remains responsible for the

final work or decision.

7. Telling people about our AI use

Where AI substantially contributed to work provided to a client, disclose that

use where a reasonable client would expect to know. If a client or customer is

interacting directly with an AI assistant rather than a person, say so. If AI

played a meaningful role in a consequential decision about someone, tell them

AI was involved. Anything we say publicly about our AI use must be accurate.

8. If you are unsure

Ask [Name, Role] at [email]. Asking is always the right call.

For publication on your website. Adjust the wording to match how you actually

work.

We use artificial intelligence tools to assist with certain parts of our work,

such as research, drafting, summarization and administrative tasks. AI supports

our team rather than replacing human responsibility. Important work and

decisions are reviewed and approved by a person before they are acted upon or

shared externally. We do not enter confidential client information into public

or unapproved AI tools. Where AI plays a meaningful role in work provided to a

client, we disclose that use when appropriate.

Optional closing line for certified organizations:

[Your organization] is certified against the Ethicality AI Use Standard

(EAUS 1.0). Our certificate can be checked on the public Ethicality registry.

Short lines you can copy where they are needed. Use the one that fits the

situation.

On a deliverable

AI tools assisted in preparing portions of this material. The final content was

reviewed and approved by our team.

On a chatbot or AI assistant

You are interacting with an AI assistant.

On a decision about a person

AI tools were used to assist our team in reviewing this matter. The final

decision was made by a person.

On a job posting

Artificial intelligence is used to screen, assess or select applicants for this position.

In a proposal or engagement letter

We may use AI tools to assist with parts of this work, such as research,

drafting and summarization. All material work is reviewed by a person before it

is provided to you, and we do not enter your confidential information into

public or unapproved AI tools.

One row per AI system or AI feature in use. A spreadsheet is the usual place; a

document works too. What matters is that the list exists, is owned, and is kept

current.

The twelve fields

• System / feature — the tool's name, or the AI feature and its host product
• Vendor — the company behind it, and the model provider behind them if different and known
• Purpose — what it's used for, in one plain sentence
• Owner — the named person accountable for this use, not a team
• Who uses it — roles or teams, including whether customers interact with it directly
• Data it touches — categories: public, internal, client-confidential, personal information
• Plan and terms — business or consumer tier; whether the vendor's terms exclude training on your data; DPA in place yes/no
• Human review — where a person checks output before it takes effect, or "none"
• Disclosure — where users or customers are told AI is involved, if anywhere
• Status — approved, approved with restrictions, under review, or to retire
• Risk note — one line: what goes wrong if this misbehaves, leaks or is switched off
• Review date — when this row gets looked at again

Columns, in order

System / feature | Vendor | Purpose | Owner | Who uses it | Data it touches | Plan and terms | Human review | Disclosure | Status | Risk note | Review date

Example row (empty — copy it and fill it in)

System / feature: [tool name, or AI feature and its host product]

Vendor: [company; model provider if different and known]

Purpose: [what it is used for, in one plain sentence]

Owner: [named person, not a team]

Who uses it: [roles or teams; whether customers interact with it directly]

Data it touches: [public / internal / client-confidential / personal information]

Plan and terms: [business or consumer tier; training excluded yes/no; DPA yes/no]

Human review: [where a person checks output before it takes effect, or "none"]

Disclosure: [where users or customers are told AI is involved, or "none"]

Status: [approved / approved with restrictions / under review / to retire]

Risk note: [one line: what goes wrong if this misbehaves, leaks or is switched off]

Review date: [Month Year]

Short form for small businesses

If the twelve fields are more than you need, a seven-field list is enough:

AI tool or system | Main business purpose | Responsible person | Information it handles | Human review (yes/no) | Internal or client-facing | Risk level

Risk levels:

• Low — internal drafting or admin on non-sensitive information; a person checks the output
• Moderate — touches client or personal information, or output reaches clients
• High — influences decisions about people: hiring, health, credit, legal rights, housing or safety

For high-risk uses, add a line on how a person can check, reject or stop the AI-assisted outcome.

How to complete it (about 15 minutes)

1. List every AI tool or AI feature anyone uses for work, including features built into software you already have.

2. Name one responsible person for each.

3. Note what information goes in, whether a person reviews the output, and whether clients see it.

4. Give each a risk level using the three categories above.

5. Set a review date, at least once a year.

The list helps show how you meet the existing EAUS 1.0 requirements on

transparency, confidentiality and human oversight. It is not a separate

requirement, and it can be shared in short form in the application.

Worked example (fictional)

Harbour Lane Bookkeeping, a 6-person firm:

| AI tool or system | Main business purpose | Responsible person | Information it handles | Human review | Internal or client-facing | Risk level |

|---|---|---|---|---|---|---|

| ChatGPT Team | Drafting client emails and summaries | Priya Shah, Office Manager | Internal; client names, no account numbers | Yes | Client-facing (emails) | Moderate |

| Microsoft Copilot in Outlook | Summarising long email threads | Priya Shah | Internal and client-confidential | Yes | Internal | Moderate |

| Receipt-scanning AI in accounting software | Reading receipts into the ledger | Tom Reyes, Senior Bookkeeper | Client financial records | Yes, every entry checked | Internal | Moderate |

| Grammarly | Spelling and tone on public posts | Priya Shah | Public | Yes | Client-facing (website) | Low |

Harbour Lane has no high-risk uses. If it began using AI to screen job

applicants, that row would be High and would note that the hiring manager

reviews every shortlist and can reject it.

Keeping it current

Add a row in the same week a tool arrives. Mark a row when one is retired.

Review each row on its review date. Where a field cannot be answered, write

"unknown" and find out — that is the point of keeping a register.

A one-page procedure for when AI-assisted work goes wrong. It helps show how

you meet existing EAUS 1.0 requirements on rules and confidentiality (R2, R3,

R15) and human responsibility (R11 to R14). It is not an extra requirement. Keep it as short

as your business allows.

1. What counts as an AI incident

• AI output that is wrong, misleading, biased or harmful and was sent, published or relied on
• Confidential, client or personal information entered into an unapproved AI tool
• Passwords or access credentials entered into any AI tool
• An AI tool, chatbot or agent acting in a way nobody approved
• A client or member of the public complaining about AI involvement

2. Who is responsible

Responsible person: [name, role]

Back-up: [name, role]

Anyone who notices a problem tells the responsible person the same day.

3. Report and escalate

1. Write down what happened, when, which tool, and who is affected.

2. Tell the responsible person. If personal information or a security credential is involved, treat it as urgent.

3. The responsible person decides whether to escalate to [owner / partner / IT / legal adviser].

4. Pause or stop

Any employee may pause their own use of an AI tool when something looks wrong.

The responsible person may stop use of a tool or feature for everyone until it

is safe. A person can always reject, override or stop an AI-assisted output or

decision before it takes effect.

5. Confidentiality and security incidents

• Delete the prompt or conversation where the tool allows it
• Change any exposed password or credential immediately
• Check the vendor's terms on data retention and training
• Consider whether clients, regulators or affected people must be told under your contracts or the law

6. Correct the output

Withdraw or correct anything inaccurate or harmful that was sent or published.

Tell the people who relied on it, in plain words.

7. Record it

Date: [ ]

What happened: [ ]

Tool: [ ]

People affected: [ ]

Action taken: [ ]

Corrective step to prevent a repeat: [ ]

Closed by: [name, date]

8. Resume safely

Resume use only when the responsible person is satisfied the cause is

understood and a fix is in place, such as clearer rules, a tool setting, or an

extra human review step.