Usage Policies and Internal Guidelines

Why Written Guidelines Are Essential

Without clear guidelines, every employee invents their own rules. One person pastes entire contracts into ChatGPT because no one told them not to, while another refuses to touch it for fear of “leaking data.” In between, a gray area emerges where everyone makes their own call. Explicit guidelines don’t restrict usage; they make it predictable, which is the condition for encouraging it without hesitation.

What the Policy Must Decide

Start by stating what your employees can do. Authorized uses generally cover drafting and improving emails, presentations, and reports; summarizing internal documents; analyzing non-sensitive data; brainstorming and structuring ideas; translation; generating code for technical teams; and using approved internal assistants, such as GPTs, plugins, and skills. There’s nothing bureaucratic about this: the list gives a communications manager the confidence to have a press release reviewed without asking three people for permission.

Next, state the prohibitions precisely, because a vague ban protects no one. Prohibited activities include entering customer personal data (names, emails, or phone numbers); importing unredacted contracts containing confidential information; using ChatGPT for automated decisions affecting individuals, such as hiring, performance reviews, or firing; sharing external conversations containing internal information; and using a personal account for professional tasks.

Then there is an intermediate category, often the most useful: conditional usage. Handle financial data only in a project reserved for Finance, after anonymizing customer names. Keep HR documents within HR projects; they have no place in broadly shared projects. Source code is acceptable if it is non-critical internal code, but excluded as soon as it touches key intellectual property.

This third register avoids the all-or-nothing trap that pushes teams to circumvent the rules. One provision cuts across all others: ChatGPT does not replace human judgment. All generated content must be reviewed before distribution. Be extra vigilant with external communications like customer emails and posts, numerical analyses since the model can hallucinate statistics, legal or regulatory content, and code destined for production.

Writing a Document People Will Actually Read

Aim for two to three pages: twenty-page guidelines don’t get read; they get archived. The structure that works in most organizations fits into six blocks. Open with a two-sentence objective, follow with the list of what employees can do, then what they cannot do. Next come five to ten best practices, a “When in Doubt” section indicating who to contact—the team’s AI champion or the IT department—and finally, the consequences of violation.

Tone matters as much as content, because an anxiety-inducing legal register discourages adoption instead of encouraging responsible use. “Any unauthorized use of ChatGPT will result in disciplinary action” shuts down the conversation, whereas “ChatGPT is a powerful tool; these guidelines help you use it to the best of your ability while protecting our data” earns the same respect for the rules without the tension.

Distribution ultimately determines real effectiveness. On Enterprise, publish them in the workspace’s AI Policy: it displays to members every thirty days and upon every update, so a new hire encounters it before their first conversation. Also open a shared project called “AI Guidelines” with conversation access, containing the policy as a reference file: anyone can ask questions there and get consistent answers without tying up the IT department. Finally, present them in every training session.

Training for Responsible Prompting

A few prompting reflexes also deserve teaching, starting with anonymization. To analyze a client case, replace names with identifiers like “Client A” or “Company X,” remove exact amounts unnecessary for the analysis, and replace specific dates with ranges when those suffice. The analysis remains valid; the exposure disappears.

Using shared projects follows the same logic. Instead of re-entering context in every conversation, preload instructions and reference documents into a shared project: more efficient for the user, safer for the organization since sensitive information stops being copied into every prompt.

Finally, plan a reporting procedure for the day someone realizes they entered something they shouldn’t have.

1. Report immediately to the workspace administrator and the IT department.
2. Delete the conversation: it disappears from history immediately, permanent deletion occurs within 30 days, and compliance logs may retain a trace.
3. Document the incident in your incident register.
4. Assess the impact: were the data actually sensitive, and what corrective measures apply?

The key here is climate more than procedure: an organization that penalizes reporting gets no reports, only incidents discovered too late.

Keeping Guidelines Alive

Static guidelines age quickly: a single new feature can make part of the examples obsolete. Hold a quarterly review to integrate emerging use cases, open a feedback channel on Slack or Teams, and trigger an update with every major ChatGPT evolution, whether a new model or a new feature. The best guidelines aren’t the most comprehensive; they are the ones that track real usage.

Your Turn

Draft your first version. In two pages, set out the objective, authorized, prohibited, and conditional uses, five best practices, the contact person for doubts, and the reporting procedure. Have a non-expert user review it: if they hesitate on a case, the rule isn’t clear enough.

Official Sources: Managing workspace settings in ChatGPT Enterprise · Chat and file retention in ChatGPT · OpenAI Compliance Platform for Enterprise and Edu customers · Projects in ChatGPT (OpenAI Help Center)

Key Takeaways

• A usage policy structures into three registers: authorized uses, precisely stated prohibited uses, and conditional uses by project.
• Human review remains mandatory, especially for external communications, numerical analyses, legal content, and production code.
• Two to three pages maximum, an encouraging rather than threatening tone, and a six-block structure from objective to sanctions.
• Distribute via the workspace AI Policy, a shared “AI Guidelines” project, and training sessions.
• Train on anonymization and shared projects, plan a four-step reporting procedure, and revise the policy every quarter.