Free template · 2 minutes
A staff AI policy, ready to send
Tick what applies to your company. The policy on the right updates as you go. Copy it, or save it as a PDF.
Your answers stay in this browser. We see them only if you ask for the Word file.
Not sure which AI is safe? Check your plan first
A starting template, not legal advice. Read it through and change anything that does not fit your company.
In plain words
Why a staff AI policy, and what goes in one
Most bosses we talk to do not know which AI plan their staff use. A personal plan can learn from what staff type, and no contract covers your data. A short written policy tells staff which AI to use and what they may put in.
Singapore's data protection regulator, the PDPC, published guidelines on personal data in generative AI in July 2026. The company is responsible for checking the AI tool it picks. The company should tell staff which personal data they may put in, and the PDPC encourages a written policy.
The policy this page builds covers which AI to use, what staff may put in and what they must never put in. It asks staff to check every answer before it goes outside the company. It names who approves new AI tools and when the policy is reviewed.
Not sure which plans are safe to allow? Check your AI plan first.
Questions owners ask
Common questions about staff AI policies
Do Singapore companies need an AI policy?
The PDPC's Advisory Guidelines on Use of Personal Data in Generative AI (July 2026) encourage a written policy. They make the company responsible for checking the AI tool it picks. They also expect the company to tell staff which personal data they may put in.
For financial institutions, MAS expects an approved list of AI tools and a ban on client data in public AI tools. Its guidelines are in force from 7 October 2027.
What should a staff AI policy say?
It says which AI plans staff may use, and that they always sign in with the company account. It lists what staff may put in, and what they must never put in. It asks them to read every AI answer before it goes outside the company. It also names who approves new AI tools, and when the policy is next reviewed.
Can staff use AI on their personal accounts?
Not for company work, even on a paid plan. A personal plan can learn from your chats, and no contract covers your data. If you allow personal plans at all, limit them to public information and turn training off on each account.
What should staff never put into AI?
Passwords, NRIC numbers and bank details, always. Any kind of information your policy does not allow goes on the same list. When staff may put in personal data, they put in only the parts the task needs.
Why does the policy mention thumbs up and thumbs down buttons?
Pressing thumbs up or down can send the whole chat to the AI company. This happens on the ChatGPT personal plans, Claude Team, Claude Enterprise and the Qwen Chat app. The policy adds this rule when you tick one of those plans.
How often should we review the policy?
Every six months. The person who approves AI tools reviews it. Providers change their terms often, so check each plan again at every review.