How to write an AI use note for your office

Why a short note helps

Staff in many offices already use AI tools on their phones and computers, often without telling anyone. Some do it well. Others paste in material that should never leave the office. Using tools without approval is sometimes called shadow AI. Banning everything rarely stops it. A short, clear note from the head of office tells staff what is allowed, what is not and who to ask.

This guide is for heads of offices, branches and sections. It helps you write a one or two page note for your own team.

First rule: follow official instructions

Your note must follow any official instruction from the government, your ministry, division or department on AI, information security, data protection or record keeping. It must never contradict them. Check what already applies before you write. If an official instruction exists, your note should explain how to apply it in your office, not create different rules. If you are unsure, ask your department's information technology or information security focal person before issuing anything. Where official guidance changes, update your note.

Your note is an internal working instruction. It does not replace policy.

What to include

Keep each section short. Staff should be able to read the whole note in five minutes.

1. Purpose. One or two sentences: why the note exists and that its aim is safe, useful AI use.
2. Approved tools. List the tools staff may use for official work, if any have been approved by your department. Say clearly that other tools must not be used for official material.
3. What data is allowed. Set out plainly what may and may not go into an AI tool. For example:

• Allowed: public documents, general drafting with no names or numbers, invented examples.
• Not allowed: classified material, citizens' personal data, personnel files, unpublished figures, anything marked Confidential or Restricted.

1. Checking. Every AI output used in official work must be read and checked by the officer before use. Facts, figures, dates and rules must be confirmed in the original source. See hallucination.
2. Responsibility. The officer who signs or sends a document is responsible for it, whoever or whatever drafted it. See accountability.
3. Record keeping. Say what should be recorded. For example, a brief note on file where AI helped with significant analysis or drafting. Official records must still be kept in the usual way. See audit trail.
4. What AI must not do. For example: make decisions about citizens, replace legal or financial advice or produce images presented as real.
5. Who to ask. Name a person or role for questions and for reporting mistakes or possible data leaks. See data leakage.
6. Review date. Say when the note will be reviewed.

Step by step

1. Find out what already applies. Collect any official instructions on AI, information security and records.
2. Ask your staff. Find out which tools they already use and for what. You cannot write useful rules without knowing this.
3. Draft the note using the sections above. You can ask an AI tool to help with structure, as long as you give it no confidential details. See drafting with AI.
4. Check it against official instructions. Remove anything that conflicts.
5. Get advice from your information technology or information security focal person if you have one.
6. Issue it and explain it. A short meeting helps staff ask questions.
7. Review it regularly. Tools and instructions change quickly.

Writing tips

• Use plain words and short sentences.
• Give real examples of allowed and not allowed use from your own office's work.
• Be practical. Rules that are impossible to follow will be ignored.
• Encourage staff to ask before they act if they are unsure.

What to check before issuing

• Does the note agree with every official instruction that applies?
• Is the list of approved tools accurate and approved by the right authority?
• Is the line between allowed and not allowed data clear?
• Does every officer know who to ask?
• Is there a review date?

When choosing a tool to approve, see questions to ask an AI vendor.