Ting Guides · For the CEO
What should an employee AI use policy say?
The short answer
It should name the AI tools and accounts staff may use, say which kinds of data may go into them, and say who approves anything in between. Classify data as public, internal, confidential or personal, and treat anything unclassified as confidential. Add how to report a mistake, and review the vendor's data terms before approving a tool.
Reviewed by Badr Al-RashedUpdated
What it depends on
Which tools, and which accounts
The same tool can treat your data differently depending on the account. OpenAI's Help Center says that for its services for individuals (Free, Plus, Pro) "we may use your content to train our models" unless the user opts out, while by default it does not use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu or its API to improve its models. A policy that only says "ChatGPT is allowed" says too little.[4]
How your data is classified
If the company has no data classification yet, write a short one for the policy: public, internal, confidential, personal. Anything without a class is treated as confidential until someone classifies it.
Who answers the in-between cases
Staff will meet cases the table doesn't cover. Name the person or channel that decides, and say how quickly they answer, or people will decide alone.
Whether a ban would hold
Blocking AI tools on company devices doesn't stop staff using them on a personal phone with a personal account, where the company has no control at all. A clear "yes, with these tools, this way" is easier to follow than a "no".
The policy text for staff
Policy text, adapt to your companyWe use approved AI tools only, and only through company accounts: tool name and account type.
Before you upload a file or paste text, check its data class in the table below. If the data has no class, or contains customer data or anything sensitive, ask person or channel before you upload anything.
Never paste passwords, API keys or any other access credentials into an AI tool.
Check any AI output before you send it to a customer or base a decision on it.
If something is uploaded by mistake, report it to person or channel straight away, with the tool, the account, the type of file and the time. Do not share the data again.
Policy owner: · Data owner: · Version: · Approved by: · Next review:
A template to adapt, not an approved policy and not legal advice.
Which data may go into which AI tool?
Fill the blank cells with your own tools and approvers. A blank cell is not permission: until it is filled, treat that data as confidential.
| Class | Example | Allowed in | Needs approval |
|---|---|---|---|
| Public | Text already published on the company website | Approved company tool | No |
| Internal | An internal marketing plan, meeting minutes | Company tool, company account only | |
| Confidential | A customer contract, special pricing, the company's source code | Yes: the data owner approves before it goes into any tool | |
| Personal | Names, mobile numbers and ID numbers of customers or staff |
What should you check about the tool's provider?
Answer each line from the provider's own terms, with the link and the date you read it.
| Check | What to confirm | Where to find it |
|---|---|---|
| Who and what | The provider, the service, the plan, and who in the company owns the account. | The order form or the admin console |
| Training | Whether your inputs and outputs are used to train models by default, and where that is written. | The provider's data-use terms or privacy policy |
| Retention | How long inputs, outputs, logs and backups are kept, and what the exceptions are. | The data retention section of the terms |
| Location | Where the data is stored and processed, and whether the provider commits to a location in writing. | The data processing agreement or the data-location page |
| Access at the provider | Who at the provider can see the data, including subprocessors and technical support. | The subprocessor list and the support access policy |
| Contract and transfer | The contract, the data processing agreement, and whether personal data leaves the Kingdom, which Article 29 of the Personal Data Protection Law addresses; note who assessed the legal requirements.[2] | The contract and the data processing agreement, read with your legal adviser |
| Leaving | How you delete the data, and how you remove access when an employee leaves the company. | The admin console and the account-deletion terms |
How do you test the policy before you approve it?
Write three fictional cases from your own work
For example: summarizing a customer contract, drafting a post from published product pages, and analysing a spreadsheet with customer names.
Give them to three people from different departments
Ask each one: is it allowed, does it need approval, and with which tool and which account?
Fix every line they disagree on
Where their answers differ, the line in the table isn't clear yet. Rewrite it until they would answer the same way.
Review the final version, then approve it
Go through it with the data owner and your legal adviser before the policy owner signs it.
What changes for companies in Saudi Arabia
General information, not legal advice. Each regulatory point summarises the official source cited beside it, as checked on the date shown under Sources; confirm how it applies to your company with your legal adviser.
SDAIA's guidelines ask for this policy
SDAIA's Generative Artificial Intelligence Guidelines for the Public (version 1, May 2025), section 5.4 on classified data breaches, say that organizations "should implement policies for GenAI use that prohibits users from entering classified information into third-party tools", and "must emphasize to their workforce that existing and upcoming legal requirements remain binding when using GenAI tools."[1]
Personal data leaving the Kingdom
If an approved tool processes personal data outside the Kingdom, Article 29 of the Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H) applies to that transfer. Its conditions include an adequate level of protection for personal data outside the Kingdom and limiting the transfer to the minimum personal data needed; the Transfer Regulation sets the exemptions from those two conditions and the safeguards they require, such as standard contractual clauses (Article 4). Settle this with your legal adviser before you approve a tool for personal data.[2][3]
Three test cases, answered with the table
ExhibitWorked example
The thirty-minute test, run on the draft group policy of the fictional Rasikh Holding. Each case is checked against the data-class table.
Data class
Public
Yes
Case
Marketing drafts a post from product pages already on the website
Tool and account
The approved company tool
Data class
Confidential
After the data owner approves
Case
A sales lead wants a summary of a customer contract
Tool and account
The approved company tool, company account
Data class
Personal
Unclear: the row is blank
Case
Finance wants to analyse a spreadsheet of customer names and mobile numbers
Tool and account
Decided by the data owner
| Case | Data class | Tool and account | Allowed? |
|---|---|---|---|
| A sales lead wants a summary of a customer contract | Confidential | The approved company tool, company account | After the data owner approves |
| Marketing drafts a post from product pages already on the website | Public | The approved company tool | Yes |
| Finance wants to analyse a spreadsheet of customer names and mobile numbers | Personal | Decided by the data owner | Unclear: the row is blank |
The decisionFill the "Personal" row before approving the policy. In this run, two of the three people answered the third case differently, because that row was still blank.
Questions people ask
Should we simply ban generative AI tools at work?
Does this policy make us compliant with the Personal Data Protection Law?
Who should own the policy?
What Ting does and doesn't do here
What we do
- In Executive AI Workshops & Enablement we help your leadership team decide which AI tools to approve, for which data, and who owns the policy.
- We run the thirty-minute test with real cases from your departments, so the unclear lines show up before the policy is signed.
Where Ting helps: Executive AI Workshops & Enablement
What we don't do
- We don't give legal advice, and we don't certify a policy as compliant with any law or framework.
- The workshops are decision sessions for leaders, not coding courses.
Sources
Primary sources only, each read in full on the date shown.
- Generative Artificial Intelligence for Public Guidelines, version 1 (May 2025), §5.4 Classified data breachesSDAIA · checked
- Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, amended by Royal Decree M/148 of 5/9/1444H)SDAIA · checked
- Regulation on Personal Data Transfer outside the Kingdom, version 2.0 (August 2024)SDAIA · checked
- How your data is used to improve model performanceOpenAI Help Center · checked
