We want a first AI data policy on paper, but do not know where to start

You do not need forty pages. A workable first AI policy fits on one or two A4s and has five sections: purpose, allowed tools, data classification, output control, incident. Write it in plain language so colleagues actually read it.

Try this first

1. 1Section 1, purpose: write in two sentences why AI is allowed and what the company wants from it. Also state explicitly what you do not want, for example customer data in public chats.
2. 2Section 2, allowed tools: list business-paid tools that are allowed, with version. Private accounts or free tiers without business terms go on the not-allowed list explicitly.
3. 3Section 3, data classification: three levels is enough. Public can go anywhere, internal only into approved tools, confidential and personal data go nowhere without written approval.
4. 4Section 4, output control: AI output is a first draft, not the final version. Whoever sends or publishes owns the facts, numbers and sources.
5. 5Section 5, incident: what to do if AI did something wrong or if customer data ended up in it. One contact person, one timeframe, no blame culture.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.