Shadow AI: How to Write an Employee AI Use Policy in One Page

Your employees are almost certainly using AI tools already, whether or not you have approved them. They paste emails into chatbots, upload documents for summaries and build small automations. That is called shadow AI, and it is a growing concern for companies of every size. Security start-ups are raising funding specifically to find unauthorised AI agents and employee-built AI apps, which shows how common the problem has become.

Banning AI outright rarely works. People find workarounds, and you lose the benefits. A short, clear policy works better.

What can go wrong

• Data leaks: confidential or personal data pasted into tools you do not control
• Wrong answers sent to customers or used in decisions
• Copyright and licensing problems with generated content or code
• Unreviewed code with security flaws
• Personal data law issues, including consent and retention under India's DPDP rules
• Prompt injection, where hidden instructions in documents or web pages manipulate an AI tool
• Cost surprises from unmanaged subscriptions

A one-page policy template

1. Purpose We encourage careful use of AI to work faster and better, while protecting customers, staff and the company.

2. Approved tools List the tools staff may use, on company accounts. Anything else needs approval from [name or role]. Review the list every quarter.

3. Data rules

• Never paste passwords, API keys, bank details or government ID numbers.
• Do not enter customer personal data or confidential contracts into any tool that is not approved for that purpose.
• Remove names and identifiers when you can.
• Follow our data protection and retention rules.

4. Human review

• A person must check AI output before it goes to a customer, is published or is used for a decision that affects someone.
• Verify facts, numbers, quotes and legal or medical claims.
• You remain responsible for your work, whatever tool you use.

5. Disclosure and honesty

• Do not present AI-generated content as a real testimonial, a real photo of an event or a real person's statement.
• Follow platform and client rules on labelling AI content.

6. Code and security

• AI-written code goes through the same review and testing as any other code.
• Do not connect AI tools to company systems without approval.
• Be careful with files and web pages from unknown sources.

7. Intellectual property Respect copyright and licences. Do not upload client work unless the contract allows it.

8. Reporting If you think you shared something you should not have, tell [contact] straight away. We will fix problems together, not punish honest mistakes.

9. Training Everyone completes a short session on safe AI use each year, with refreshers when tools change.

Make it work in practice

1. Run a short amnesty survey. Ask staff which AI tools they use and why. You will learn where the real needs are.
2. Provide good approved options. If the official tool is worse than the free one, people will use the free one.
3. Use business plans with data controls instead of personal accounts.
4. Set technical guardrails: access controls, logging and data loss prevention where practical.
5. Keep an inventory of AI tools and automations, with an owner for each.
6. Review regularly. AI changes quickly, so your policy should too.

Get help

KalzTech helps businesses set up secure AI tools, workflows and simple governance. Contact us and we will help you tailor a policy to your team.