Writing your team's AI usage policy

1Ten articles based on the real perimeter

An effective usage policy rests on verifiable technical facts. Microsoft confirms that prompts and responses are logged, stored in the enterprise tenant for audit purposes, and accessible by administrators. They are never used to train foundational artificial intelligence models.

Web searches follow a separate regime: concise, anonymised search terms transit outside the European Union boundary to query Bing. Uploaded files remain hosted in work OneDrive accounts under sensitivity label controls. Any agent accessing SharePoint requires prior administrative enablement.

The regulatory framework rests on two core provisions of the AI Act. Article 4 requires organisations deploying AI systems to ensure an adequate level of AI literacy across their workforce, aligned with European Commission and OECD benchmarks.

Article 50 mandates clear disclosure for AI-generated content, particularly synthetic images and published materials. A team policy does not recite statutes: it translates statutory principles into daily observable workplace behaviours.

Here is the ten-article template, to be adapted to your team.

1. Purpose and scope. This policy applies to the team's use of Copilot Chat, with the work account and the green shield shown. The personal account is excluded. It complements the organisation's IT charter.

2. What may be pasted. Public documents, fictional documents, internal documents without a restrictive sensitivity label. Test: I paste only what I could email to an external contractor. Names of people, amounts and health data are removed or replaced with placeholders.

3. Logging. Everyone knows that their prompts and the answers are retained and viewable by the administrator according to the organisation's rules. We write in Copilot Chat as in a work email.

4. Web search. Web queries leave the organisation. No internal information is phrased in a question asked with web search enabled.

5. Verification and responsibility. Every figure, date, name and quotation is checked against a source before use. A deliverable that commits the organisation is proofread by its author, who remains responsible for it. Legal, HR and medical questions go through an expert.

6. Transparency. A deliverable produced substantially with Copilot Chat says so when the recipient is external. Every generated image is flagged as such and shows neither a real person nor a real event.

7. Agents. An agent shared within the team has instructions reviewed by the contact person and contains no confidential data. Any access to the organisation's shared data is requested from the administrator, never enabled on one's own initiative.

8. Shared files and pages. A file uploaded for a sensitive task is deleted from OneDrive after use. A shared Copilot page follows the classification of the most sensitive document it contains.

9. Training. Every team member completes the beginner course before any use on internal documents, and the intermediate course if they produce deliverables for external recipients. The contact person keeps the list of courses completed.

10. Incidents and review. Any doubt (document pasted by mistake, suspicious answer, hidden instruction in a file) is reported to the contact person the same day. The policy carries a version number, a date, a contact person, and is reviewed every six months.

Tap to enlarge

2A team policy without invented promises

A purchasing manager wants a first draft of a policy for his team of twelve.

Weak prompt, in the same conversation:

Write an AI usage policy for my team.

Copilot produces two generic pages, valid for any tool, with phrases such as "do not share sensitive data" and a false promise: "conversations are never retained".

Strong prompt: Turn 1 (drafting the ten articles grounded in technical architecture):

You are the assistant of a procurement department lead with twelve team members using commercial data protection in Copilot Chat.
Draft a usage policy in ten short articles, each phrased as an observable behaviour.
Mandatory technical constraints: tenant logging, anonymised web search queries exiting the EU boundary, OneDrive storage for files, admin approval for SharePoint agents.
Style rules: professional tone, no unexplained legal jargon, zero unverifiable promises.
End with four critical questions to validate with enterprise IT.

Copilot delivers the ten articles alongside four technical validation checks.

Strong prompt: Turn 2 (operational adjustment for log retention and breach escalation):

Our IT department confirmed a 90-day log retention period and requires immediate escalation if confidential records are pasted.
Update articles 3 and 10 to include this numerical timeframe and a mandatory two-hour incident escalation path to the team focal point.

Copilot updates both articles, converting the team charter into an enforceable operational standard.

What changes: technical facts eradicate invented assurances. Observable formatting turns vague guidelines into measurable habits. Direct alignment with IT leadership guarantees corporate compliance.

3Adapt the ten articles to your own team

Starting prompt, to be improved:

"Write the rules for using Copilot in the team."

Specify your team composition and regular working documents. Incorporate the factual Copilot Chat parameters covered in the concept: logging, web search, OneDrive storage, and data sensitivity classifications.

Require ten articles phrased as observable behaviours, followed by necessary IT validation queries. Tailor the generated template to your operational needs, name a lead contact, and schedule a six-month review. Have a colleague review the document before team rollout.

Self-assessment grid: (a) every article describes a behaviour that can be observed; (b) no article promises what Microsoft does not guarantee; (c) contact person, version and review date appear at the top.

Open the prompt composer