The AI usage policy your staff might actually read
A usage policy fails at the exact length where people stop reading it. The one-page version that answers the five questions employees genuinely have.
Most AI usage policies are written to be defensible and achieve it at the cost of being read. Eleven pages, legal review stamps, paragraph 7(c) on acceptable prompt hygiene. Meanwhile two-thirds of professionals use AI tools they believe are banned, which tells you exactly how the eleven pages are performing. A policy nobody reads is a liability dressed as one less liability.
Employees have five questions. Answer them on one page, in the order they are actually asked.
Which tools can I use? A short named list, with the sanctioned account to use them under. Not categories, names. "The company ChatGPT workspace, Copilot under your work login" beats "approved generative AI solutions" every time it is tried.
What can I paste into them? The traffic-light version: public information, green. Internal documents, yellow, sanctioned tools only. Customer data, credentials, anything regulated: red, never into anything, and here is who to ask when the deadline is tomorrow and the answer feels unclear.
Do I have to say when I used AI? State it plainly for the two cases that matter: external deliverables and anything a regulator might read. (The chatbot-disclosure rules arriving in August 2026 make some of this non-optional in Europe anyway.)
Who is accountable for AI-assisted work? The human who shipped it. Say it in one sentence; it settles a hundred hallway debates.
What happens if I got it wrong last month? Amnesty for disclosure, forever. Without this clause the policy launches with an installed base of secrets, and your shadow inventory stays fiction.
A note on tone, because it decides whether the page works: write it like a colleague explaining the deal, not like a legal department covering a flank. "Use the sanctioned tools, check what ships, ask when unsure, and nobody gets punished for honesty" fits on an index card and survives being read aloud. The policies that fail read like terms of service, and staff extend them exactly the respect they extend terms of service, which is a scroll and a click. The page is not really a control document. It is the company saying, in writing, that it would rather know the truth than perform having rules, and that sentence is the entire foundation the rest of the program stands on.
Ship the page, review it quarterly, and let the eleven-page version live in the annex where lawyers can visit it.