Separate uses with different consequences.
An employee drafting an internal outline, a developer suggesting code and a customer-facing assistant create different review questions. Record what the tool may produce, who relies on it and what happens if the result is wrong. The same product may need several use-case records.
Distinguish experimentation from operational deployment. A test with synthetic information should not silently expand into routine use of customer or employee information without a fresh decision.
Explain what people may put into the tool.
Set practical rules for confidential information, personal data, intellectual property and third-party material. Connect those rules to the actual service terms and configuration. People need to know which account or approved environment to use and where to ask when a case is unclear.
Avoid a policy that only says 'use AI responsibly'. Give examples relevant to the work: meeting notes, customer correspondence, source code or unpublished commercial plans. Use hypothetical examples that do not expose real sensitive records.
Define review before outputs are relied on.
Specify who checks factual accuracy, suitability, security and rights-related concerns before an output is published or used in a consequential process. Identify uses that require specialist review or are outside the approved scope. A fluent answer should not be treated as evidence of correctness.
Transparency obligations depend on the provider or deployer role and the type of interaction or content. The linked guide separates those questions rather than applying one generic label rule to every output.
Keep tools, policies and suppliers aligned.
Maintain a list of approved uses, relevant service versions, responsible owners and review dates. Revisit the decision when a supplier changes its terms, enables new features or alters a model dependency. Include a route for employees to declare an unlisted tool or report an unexpected result.
An EUAIC scope can bring these records into a consistent intake and review process. Technical filtering, enforcement and integrations require separate agreement; policy documentation alone does not ensure that a restriction is technically enforced.