How to write an AI policy your staff can follow

Many organisations already have an AI policy. It often sits on the intranet and urges people to be careful. Meanwhile, staff use AI in their work, sometimes in services nobody has approved. A policy only earns its keep when it answers the questions that actually come up at the desk. Which tool may I use, what may I paste in and who looks at the result?

What a policy needs to answer

In their guidelines for public administration, Digg and IMY, the Swedish agencies for digital government and for data protection, recommend that every organisation draws up its own AI policy. It need not be called that, but it should form part of how the organisation is governed and managed. The guidelines set out what it should cover. That means purpose and scope, which tools may be used, which information may be used and which may not, who reviews what AI produces, who is responsible and what training users need. The questions suit a company just as well as a public authority.

What makes a policy useful is that the answers are concrete. A sentence saying sensitive information must not be used says little if people do not know what counts as sensitive. It becomes easier when the policy ties in with the data classification already in place and gives examples from everyday work, such as a customer case, a draft contract or an internal report.

Approved tools that are good enough

A ban without an alternative is rarely followed. In September 2026 the UK’s NCSC wrote that staff turn to tools the organisation has not approved when policies fail to keep pace with their needs. It recommends an open security culture and secure tools that fit the work. The aim is to reduce the risk, since shadow AI can rarely be eliminated entirely.

That is why the approved tools belong in the policy. People need to know what they may use and for what, and the tools need to be good enough to be chosen. Public AI services can have a place for general tasks that do not concern the organisation. Work with internal information belongs in a tool where the organisation knows how the information is handled. Digg’s own policy lets staff use the tools the agency has approved, and no private licences.

Responsibility and review

AI can never carry the responsibility. Whoever uses a tool answers for the result in the same way as for any other work, and decisions that affect individuals are made by a person. The policy should say who reviews what AI produces before it is used, and how that review can be seen afterwards when an AI answer has informed a decision.

AI agents, which can take actions on their own, need one more step. Digg’s own policy requires a risk assessment before such tools are taken into use. That is a sensible order of things beyond public authorities too, since an agent can do more harm than a wrong answer.

Knowledge that keeps the policy alive

The EU AI Act requires organisations that use AI systems to take measures to support their staff’s AI literacy. The requirement has applied since February 2025 and was adjusted in 2026, but the obligation remains. Training need not be long. It does most good when it deals with the tools actually in use and with where the limits lie.

A policy written once and then left alone soon goes out of date. Digg makes its own guideline valid for one year at a time. It is a simple way to make sure the policy keeps up as tools and rules change, and that staff are asked what works and what is missing.

How it works in iSearch

iSearch can be the approved tool for work with internal documents. The assistants answer from your own knowledge banks and show which documents were read, and your questions and documents are never used to train models. Sign-in uses SSO and MFA, role-based access controls who reaches what and a tamper-evident audit log shows who did what.

Read more about sensitive information in AI and rolling out AI search, or book a walkthrough.