Write your policy, and roll it out.

You've got all the pieces now: why a policy beats a ban, the three-tier data scheme, your approved and configured tools, and the human-check and disclosure rules. The last step is the one that actually protects your business, because a policy in your head protects no one. This lesson turns it into two short documents and a calm way to roll them out.

Keep the policy to one page

A long policy is a policy nobody reads, which means a policy nobody follows. The aim is a single page that covers the decisions that matter and skips the lecture. Five sections do it:

• What's approved. The short list of tools from your register, and what each is approved for. Anything not on the list isn't approved.
• The data line. The three-tier rule in a sentence or two: green is free to use, amber goes in approved tools only, red never goes near a public chatbot.
• The human check. Who reviews and signs off anything customer-facing, factual, legal or financial before it goes out.
• Disclosure. When and how you tell people AI was involved, with your reusable disclosure line, mindful of the December 2026 transparency obligation.
• Who owns it. The named person responsible for the policy, and the date you'll next review it.

That's a real, defensible AI policy on one page. The playbook gives you the fill-in template, so it's a matter of dropping in your specifics rather than starting from a blank document.

Pair it with a staff one-pager

The policy is the reference. The staff one-pager is what changes behaviour day to day, because it's the bit your team actually keeps to hand. Same content, friendlier shape: the approved tools, the green/amber/red cheat-sheet, the "check anything that matters" rule, and the gut-check question, "would I be fine if this turned up outside the business?" Stick it by the kettle, drop it in the onboarding pack, and you've made the safe path the obvious one. A policy people can follow without re-reading a document is worth ten that sit in a folder.

Roll it out without the eye-rolling

Nobody loves a new policy, so frame it as what it is: permission to use AI well, not a crackdown. A light rollout sticks better than a stern one:

• Explain the why in five minutes. Your team is already using AI, this lets them do it safely and openly, and it protects them and your clients. People follow rules they understand.
• Make it easy to say yes. Point them at the approved tools, the cheat-sheet and the one question. Easy beats strict every time.
• Open the door for more tools. Tell people how to ask for a tool to be added, so the register grows deliberately instead of going underground.
• Put a review date on it. The tools and the rules change, so a quick revisit every few months keeps the whole thing current. Set the date now.

Keep the summary handy

To make this stick, grab the free one-page summary: the AU context, the three-tier scheme, the tool-config checklist, the human-check and disclosure rules, and the December 2026 hook. Print it, keep it by the desk, and you've got the whole course in arm's reach while you finish your policy.