Find out what employees use AI for
Ask the team to show specific examples: the task, the tool, the information they entered and what they did with the result. Include successful and unsuccessful attempts. Otherwise you will see only the demonstrations people are proud of.
Explain that the purpose is to establish sound routines, not monitor individuals. Ask how often AI is used, where it saves time, which errors recur and how much checking or rewriting is required.
Distinguish between information and consequences
Generating ideas from public information requires different rules from processing internal documents or personal data. An error in a private note may also have less serious consequences than an error in content published or sent to a customer.
Create a simple overview with three levels: use that is permitted with approved tools, use that requires prior approval and use that is not permitted. Include concrete examples from the team so employees do not have to interpret general rules in every situation.
Review the team's experience regularly
Set up a short recurring session in which the team shares new use cases, repeated errors and changes to tools. Update templates when experience reveals a better method, and remove advice that no longer applies.
Give one person responsibility for keeping the overview current, while the specialists doing the work contribute examples. Involve privacy and security owners when people begin using new types of information or external services.