Writing your team's AI usage policy

1Ten articles based on the real perimeter

A usage policy is written from facts, and Copilot Chat provides precise ones. Microsoft states that prompts and answers are logged, retained in the tenant for audit, and viewable by the administrator. They are not used to train the models. Queries sent to the Bing search engine follow a separate regime. They are a few words, without an identifier, sent outside the European Union data boundary. Uploaded files are stored in the work OneDrive. Sensitivity labels apply. An agent that reads shared data is billed per use and enabled by the administrator.

The regulatory frame fits in two articles of the AI Act, the European regulation on artificial intelligence. Article 4 requires organisations that deploy an AI system to ensure a sufficient level of AI literacy among their staff. The AI literacy framework of the OECD and the European Commission describes what that literacy covers. Article 50 requires generated content, images in particular, to be flagged. A team policy does not cite the law in detail; it derives observable behaviours from it.

Here is the ten-article template, to be adapted to your team.

1. Purpose and scope. This policy applies to the team's use of Copilot Chat, with the work account and the green shield shown. The personal account is excluded. It complements the organisation's IT charter.
2. What may be pasted. Public documents, fictional documents, internal documents without a restrictive sensitivity label. Test: I paste only what I could email to an external contractor. Names of people, amounts and health data are removed or replaced with placeholders.
3. Logging. Everyone knows that their prompts and the answers are retained and viewable by the administrator according to the organisation's rules. We write in Copilot Chat as in a work email.
4. Web search. Web queries leave the organisation. No internal information is phrased in a question asked with web search enabled.
5. Verification and responsibility. Every figure, date, name and quotation is checked against a source before use. A deliverable that commits the organisation is proofread by its author, who remains responsible for it. Legal, HR and medical questions go through an expert.
6. Transparency. A deliverable produced substantially with Copilot Chat says so when the recipient is external. Every generated image is flagged as such and shows neither a real person nor a real event.
7. Agents. An agent shared within the team has instructions reviewed by the contact person and contains no confidential data. Any access to the organisation's shared data is requested from the administrator, never enabled on one's own initiative.
8. Shared files and pages. A file uploaded for a sensitive task is deleted from OneDrive after use. A shared Copilot page follows the classification of the most sensitive document it contains.
9. Training. Every team member completes the beginner course before any use on internal documents, and the intermediate course if they produce deliverables for external recipients. The contact person keeps the list of courses completed.
10. Incidents and review. Any doubt (document pasted by mistake, suspicious answer, hidden instruction in a file) is reported to the contact person the same day. The policy carries a version number, a date, a contact person, and is reviewed every six months.

Tap to enlarge

2A team policy without invented promises

A purchasing manager wants a first draft of a policy for his team of twelve.

Weak prompt.

Write an AI usage policy for my team.

Copilot produces two generic pages, valid for any tool, with phrases such as "do not share sensitive data" and a false promise: "conversations are not retained".

Strong prompt.

You are the assistant of the head of a twelve-person purchasing team that uses the Copilot Chat included in Microsoft 365, without a paid licence. Write a usage policy in ten articles of five lines at most, each phrased as an observable behaviour. Facts to respect and not to contradict: prompts and answers are logged and viewable by the administrator; they are not used to train the models; web queries leave the organisation; uploaded files are stored in the user's OneDrive; an agent that reads SharePoint is billed per use and enabled by the administrator. Constraints: formal address, no technical term without explanation, no promise about what Microsoft does not guarantee. End with the list of points I must have validated by the IT department.

Copilot returns ten short articles, consistent with the facts provided. It adds a list of four points to validate, including the retention period of the logs and the rule for sharing agents.

What changes. The facts provided prevent invented promises. The "observable behaviour" constraint turns principles into checkable rules. The list of points to validate acknowledges that the team policy fits within the organisation's.

3Adapt the ten articles to your own team

Starting prompt, to be improved:

"Write the rules for using Copilot in the team."

Add the composition of the team and its usual documents. Take the facts of the Copilot Chat perimeter listed in "The concept". Impose the format in ten articles of five lines, the formal constraints, and the request for a list of points to have validated. The composer below helps you fill in the Constraints field. Then adapt the ten-article template to your team, name a contact person and date it. Have it reviewed by a colleague; failing that, reread it yourself 24 hours later, article by article, looking for what a reader could misunderstand.

Self-assessment grid: (a) every article describes a behaviour that can be observed; (b) no article promises what Microsoft does not guarantee; (c) contact person, version and review date appear at the top.

Open the prompt composer