How to Create a Generative AI Use Policy: Checkpoints for Internal Rules, Information Management and Allocation of Responsibility
Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.
When I receive a request such as "we want to create a use policy for generative AI used within the company," the first thing I check is to whom the document is addressed and what behavior it is meant to encourage. Faced with the questions of how far to allow the use of AI tools such as ChatGPT and how to prevent employees from entering important information without authorization, many companies try to prepare an internal document that simply lists prohibited matters. In reality, however, regulations that list only prohibitions rarely take root in day-to-day operations. Rules function effectively only when they set out, along the flow of actual work, the scope of work in which frontline staff can actually use AI, concrete examples of information that must not be entered, situations in which human review must be inserted, procedures for introducing external tools, and the reporting line when a violation or incident occurs.
Another premise I would like to share is that a generative AI use policy is not a document that is finished once it has been written. Legal frameworks such as AI legislation and the Act on the Protection of Personal Information (APPI), as well as the terms of use and features of each AI tool, are updated from time to time. The basic approach is to check the latest official information and service terms not only at the time of drafting but also after operation begins, and to review the policy flexibly in line with how AI is actually used within the company.
The Role and Positioning of a Generative AI Use Policy
A generative AI use policy is an internal regulation or guideline that sets basic rules for using generative AI within a company. It covers the business use of a wide range of AI services, from general-purpose conversational AI tools to tools specialized in preparing minutes or searching internal information. The specific content it sets out includes which services may be used, which input data is prohibited, how to verify outputs, and procedures for managing personal information and trade secrets.
What should be emphasized here is not to let the policy end as a formal warning from the legal department to the front line. Even if frontline staff are handed a document that simply says "do not enter confidential information," they cannot judge which information falls under it. Is it acceptable to enter information if the customer's name is masked? Is a draft contract clause fine? How should notes from internal meetings or program code under development be handled? Unless concrete examples tied to such everyday work are given, frontline staff have no choice but to judge based on their own personal sense, and the result is no different from having no rules at all.
A policy is not a document for uniformly restricting frontline use. Its purpose is to draw the line between areas where AI can be used with confidence and areas requiring additional checks, so that the company can enjoy the benefits of AI soundly, and to create a common foundation on which the legal department and business departments can make decisions using the same standards.
Challenges That Arise Precisely Because AI Is a Tool Individuals Can Use
The fundamental reason a generative AI use policy is needed is that generative AI is a tool that can easily be introduced at an individual's own discretion.
Employees can immediately start drafting text, translating or generating programs simply by creating their own accounts. While this can make individual work more efficient, it may lead to customer information, unpublished business plans or technical trade secrets being sent to external services without the organization's knowledge.
In addition, text output by AI appears natural and persuasive at first glance, so it is difficult to notice the risks of factual errors or rights infringement it may contain. If AI output is used as is in work where accuracy matters, such as legal, human resources and customer service, it may lead to the spread of incorrect information or breach of contract.
In companies without a clear policy, usage policies become fragmented by department. The sales department uses AI to prepare proposals, the development department uses it to generate code automatically, and the human resources department uses it to prepare job postings and interview notes, each judging by its own standards. Even if each department's judgment is reasonable, the company falls into a state in which it cannot explain internally or externally what risks it accepts as a whole and to what extent.
If a systematic policy exists, the AI tools that may be used, the data that may be entered and the contact point when problems occur are defined, making it easier for frontline staff to judge the scope of permitted use. When business partners or customers ask, "How does your company control generative AI?" or "Is there a possibility that our data will be entered into AI?", the company can give a well-founded explanation based on its regulations, which helps protect its social credibility.
Concrete Steps for Creating the Policy
The first step is to define the scope of tools covered. Decide how far the regulations will extend, such as general-purpose chat-type AI, AI specialized for particular tasks, and AI embedded in the company's own systems. Listing only specific service names will cause new tools to fall outside the regulations each time they appear, so adopt a comprehensive definition that also captures similar mechanisms that may appear in the future.
Next, establish risk classifications according to the type of use. For example, general text editing, foreign-language translation and summarizing public information that do not involve confidential information can be positioned as relatively manageable types of use, while uses involving personal information, legal judgments or materials to be published externally are distinguished as uses requiring additional checks. However, even general paraphrasing or translation may carry high risk depending on the content of the data entered, so avoid uniformly treating them as minor uses. Also bear in mind that risk classifications are guidelines tailored to the company's circumstances, not categories uniformly prescribed by law.
For prohibited input data, specify it by giving concrete names. Show as concrete examples customers' company names and individuals' names, unpublished financial figures and business strategies, and login credentials and API keys for various systems. Also set out the approver, the services that may be used and the conditions for exceptionally permitting input, such as where anonymization has been applied or a secure enterprise-only environment is used. The labels "anonymized" or "enterprise environment" alone do not necessarily mean that legal or contractual conditions are satisfied.
Rules for verifying outputs are also essential. Specify a step in which a person checks the facts and whether others' rights are infringed before deliverables created by AI are published or submitted externally. For legal documents, advertising materials, disclosure materials for investors and the like, establish a system that inserts a check by each responsible department.
For procedures to introduce external tools, create a process in which the department wishing to use a tool applies with its purpose, the data it plans to input and whether the data will be used for training, and the information systems department and legal department review it. For business use of personal accounts, taking into account that data handling terms may differ between free plans, paid plans and enterprise plans, clearly determine whether use is permitted, the scope of information that may be entered, and the company's authority to check logs and deliverables.
Furthermore, separately from the main regulations, it is effective to prepare a one-page operating memo that frontline staff can refer to daily. Distributing a document that concisely summarizes examples of what may be entered, examples of what must not be entered and whom to contact when in doubt is easier to use for daily decisions than a thick set of regulations. With respect to log collection and audits, defining in advance the purpose of monitoring usage and who has viewing authority also takes employees' privacy into consideration. In training, show examples of permitted use and examples to avoid, and make known whom to consult when in doubt and how to report violations or incidents.
Specific Challenges Facing Each Department
For management, building a system that fulfills company-wide accountability is a major challenge. If management does not grasp how AI is being used within the company, it cannot respond accurately to inquiries from stakeholders. Management bears the role of clearly setting out policies both for promoting use and for managing risk.
For the legal department, an important role is not merely to impose prohibitions, but to show where to draw the line so that the front line can use AI safely while complying with laws and contractual relationships.
The information systems and security departments are pressed to deal with shadow AI, the unauthorized use of unapproved tools. They reduce risk by combining access restrictions, provision of approved tools, appropriate log management and security training.
In business departments, the challenge is to instill awareness not to over-trust AI output. No matter how fluent generated text is, its content is not necessarily correct. It is essential to maintain a shared understanding that AI is a tool for creating initial drafts and doing preparatory work, that the company's personnel make the final decision, and that responsibility cannot be shifted to the AI itself.
In the human resources department, the issues are protecting personal information and ensuring fairness when using AI in recruitment screening, personnel evaluations and labor consultations. It is necessary not to leave important evaluations of people to AI and to maintain a mechanism by which people can verify the basis for decisions.
Reviewing the Draft Against Actual Operations
AI can be used to help create a first draft of a use policy and to check for gaps in prohibited input information, approval procedures and incident response. However, simply asking it to "create a policy" will not produce a document suited to your industry and the information you handle. Review the draft after also setting out the tools in use and the flow of legal review. Because AI's legal explanations and information on terms may be out of date, a person should check official information and the company's own contracts. Review the policy in light of actual usage to see whether it avoids both a state in which prohibitions are so broad that necessary use is impossible and a state in which matters are left to the front line and important information leaks.
A generative AI use policy is not something you create once and are done with; it needs to be updated regularly in response to changes in how the company uses AI and revisions to related laws and guidelines. It is important to establish a system in which legal and information systems staff keep up with the latest information and to keep revising the policy in line with actual frontline operations.
LegalAgent provides support tailored to each company's situation, from creating new internal policies to reviewing and revising existing regulations.
Services connected to this topic