A rule should help someone act
“Use AI safely” is not a useful rule. It does not tell a person what they may do, what needs checking or who owns the result.
Good rules begin with the work.
Rule 1: Say what AI is for
Name the result, not the tool. For example: “Use AI to prepare the weekly customer view from approved sources.”
Also name what it is not for. This may include private staff choices, final legal advice or claims that cannot be traced to a source.
Rule 2: Name the calls AI may and may not make
Make three lists:
AI may do this alone: low-risk work with a clear rule and an easy way to undo it.
A person must approve this: customer messages, money, public claims or changes that affect people.
AI must never do this: work the business cannot explain, check or take back.
Use examples from your own company. People follow a clear case better than a long policy.
Rule 3: Keep the checks beside the work
For each job, show:
- which sources are allowed;
- what a good result looks like;
- who checks it;
- when the system must stop;
- where the reason is recorded.
Do not hide these checks in a separate document no one opens.
Rule 4: Give the result an owner
An AI system cannot own the business result. Name the person who can change the rule, stop the system and answer for the final work.
The owner also needs time to review weak cases. A person “in the loop” with no time or power is not a real check.
Review the rules with real cases
Once a month, look at one good result, one weak result and one case where the AI asked for help. Change the rule if the evidence has changed.
A ten-minute starting point
Take one AI job and finish these lines:
- The result we want is...
- AI may carry...
- A person must decide...
- The system stops when...
- The owner is...
If the team can answer those five lines, it has a working rule it can use today.