Most employees are already using AI at work. The question is whether they are doing it inside a policy or around one.
A short, clear AI usage policy protects customer data, sets expectations and gives you something to point to when a client asks. This is the outline we use with Indian SMBs.
For the legal background, see AI and the DPDP Act. For the risk side, see AI security risks Indian businesses ignore.
The eight sections
| Section | What it should say |
|---|---|
| Purpose and scope | Who and what the policy covers |
| Approved tools | What staff may use, and what they may not |
| Data classification | What can and cannot go into a prompt |
| Prohibited inputs | Customer data, credentials, contracts, source code |
| Human review | Which outputs need a person before use |
| Disclosure | When AI assistance must be declared |
| Logging and retention | What is recorded and for how long |
| Incident response | What to do after a leak or bad output |
Keep it to two pages. A policy nobody reads protects nobody.
1. Purpose and scope
State that the policy applies to all employees, contractors and interns, on company and personal devices, for any work-related task.
Name an owner. A policy without an owner is a document, not a control.
2. Approved tools
List the tools you allow, by name. For each, note:
- Whether it is approved for customer data.
- Whether it has a data-retention or training clause.
- Whether it is paid or free.
- Who administers the account.
Free consumer tools often train on inputs. That single fact decides whether they are allowed near customer data.
3. Data classification
Use three levels:
| Level | Examples | AI rule |
|---|---|---|
| Public | Website copy, published prices | Any approved tool |
| Internal | Meeting notes, drafts, internal reports | Approved tools only |
| Restricted | Customer data, employee data, contracts, credentials | Prohibited, or only in a private deployment |
Make the restricted list explicit. “Sensitive data” is too vague to follow.
4. Prohibited inputs
At minimum:
- Customer names with contact details.
- Employee records and salary data.
- Aadhaar, PAN, passport or bank details.
- Passwords, API keys and access tokens.
- Unpublished contracts and legal advice.
- Source code from client projects, unless the tool is approved for it.
5. Human review
Define which outputs need a person before they are used or sent:
- Anything customer-facing.
- Anything with a number, price or legal term.
- Anything used in hiring, credit or eligibility.
- Anything published under the company name.
The reviewer is accountable for the output. “The AI wrote it” is not a defence.
6. Disclosure
Decide when staff must say AI was used:
- Customer-facing content in regulated industries.
- Proposals and reports sent to clients.
- Images or media that could be mistaken for real.
- Any output that is published as original research.
Internal drafting usually does not need disclosure. External publication often does.
7. Logging and retention
Record:
- Which tool was used.
- What data was entered.
- Who approved the output.
- When it was deleted.
Under the DPDP Act, retention should be limited to what the purpose requires. Do not keep prompts containing personal data indefinitely because they are convenient.
8. Incident response
Define what happens when someone pastes restricted data into the wrong tool:
- Stop using the tool.
- Report to the policy owner within 24 hours.
- Identify what was exposed and to whom.
- Request deletion where possible.
- Assess whether notification is required.
- Record the incident and fix the cause.
A fast, blameless report is more useful than a perfect policy.
Rollout in four steps
- Draft the two-page policy with the owner named.
- Publish it where staff actually look, and require acknowledgement.
- Train with three real examples of what not to paste.
- Review every quarter and after any incident.
Common mistakes
- Copying a policy from a US or EU company without DPDP references.
- Listing tools that staff cannot actually access.
- Banning AI entirely, which pushes use underground.
- No owner, so nobody enforces it.
- No examples, so staff cannot apply the rules.
- No review date, so the policy is stale within a year.
FAQ
Do Indian SMBs need an AI policy?
If you handle customer or employee data, yes. It sets clear rules and shows clients you have controls.
Can staff use ChatGPT at work?
Only under the rules you set. Many free tools retain or train on inputs, so define which data is allowed.
Does the DPDP Act mention AI?
It sets obligations for personal data processing, which includes AI tools that handle personal data. The policy should reflect those obligations.
How long should the policy be?
Two pages. Longer policies are rarely read and rarely followed.
Next step
If you need a policy reviewed or a private AI setup that keeps data inside your environment, contact 24Bit System. Our DPDP compliance guide covers the documentation, and AI security risks covers the technical controls.
