Writing an AI Use Policy for Your Training Team

Most L&D teams are already using AI, with or without a policy. The choice isn't whether it happens — it's whether it happens with agreed limits. A short, practical policy beats a long, ignored one.

Start with the two real risks

Almost everything worth putting in the policy addresses one of these:

• Confidentiality — client material, employee data, or commercially sensitive content going into a third-party system.
• Accuracy — unverified AI output reaching learners as if it were checked.

Policies that address these two well are useful. Policies that enumerate approved tools go stale within months.

What to say about confidentiality

Be specific about categories rather than tools:

• What must never be pasted into a general AI tool — personal data, client-identifying material, anything under NDA, unreleased commercial information.
• What's fine — your own published policies, generic training content, material the client has agreed can be processed.
• Where the line sits on client work: many client contracts now address AI processing explicitly. Check before assuming.

Note the distinction between consumer tools and API or enterprise arrangements — data handling terms differ substantially, and the policy should say which the team is permitted to use for what.

What to say about accuracy

The clearest formulation is an accountability statement: a named person is responsible for the accuracy of every piece of content that reaches a learner, regardless of how it was drafted.

That single sentence does more work than a page of process. It means nobody can point at the tool when something's wrong.

Add the specific check: every factual claim traceable to a source document, and no legislation, standards or regulatory detail published without verification against the primary source.

What to say about disclosure

Decide whether AI involvement is disclosed to clients, and be consistent. There's a reasonable range of positions here — some clients care a great deal, others assume it and don't mind. The failure mode is being inconsistent, or being asked directly and having no agreed answer.

What not to put in it

• A list of approved tools — it will be out of date before the ink dries. Describe categories and requirements instead.
• A blanket ban — it drives usage underground where you can't see it.
• Detailed prompt guidance — that's a training resource, not a policy.

Keep it to one page

A policy people can read in two minutes gets followed. Confidentiality categories, the accountability statement, the verification requirement, and the disclosure position. Everything else is guidance, and guidance belongs somewhere people can actually find it.