We roll out AI usage rules inside companies

We start from what is already happening

The first sentence we hear in the management meeting is usually: "people here don’t really use it". An hour later, after talking to the teams, it turns out three departments do — on personal accounts, with nothing agreed about what may be pasted in. The scale shows up in a study by Experience Institute and Praca.pl (July 2026, N = 1,636): only 27% of employees confirm their company has clearly defined rules for using AI, and just 16% ever wonder whether the way they use these tools is legal. So we don’t start by writing a document. We start by establishing what is genuinely in use — because a document that ignores that describes a company which does not exist.

What the rollout looks like

Five steps, two to three weeks

• Discovery — short conversations across a few teams and a list of the tools actually open on company machines.
• Decisions with management — what is allowed, what is never allowed and what requires asking first. Three lists, not twenty clauses.
• One page — rules written in the team’s own language, with a named person to ask, a contact channel and an effective date.
• The announcement — a meeting, not an email. People need to ask out loud and hear that asking is fine.
• A 30-day review — which questions came back, what the team works around, what to add or delete.

The five mistakes we see most often

• A document written without a single conversation with the team. It bans things nobody does and says nothing about what happens daily.
• A list of prohibitions with no list of what is allowed. If you never say what is fine, people assume nothing is — and carry on quietly.
• No name. "In case of doubt, contact the relevant department" means, in practice: contact nobody.
• Banning tools the team already uses without naming an alternative. The effect is the opposite of the intent — usage moves to private phones.
• Nothing about mistakes. If nobody says what happens when someone pastes the wrong thing, you will hear about it as late as possible.

What comes up in conversations with the team

We run these conversations without managers in the room and without names in the notes — otherwise you only hear the answer people consider safe. The questions repeat in every company, whatever the industry:

• "Can I paste part of a contract to get it summarised?"
• "If I admit I use AI, will I look like someone who cannot do the work alone?"
• "Can anyone in the company see what I ask the model?"
• "I have my own paid account — am I allowed to use it for work?"
• "Who is responsible if the model gets a number wrong and I miss it?"

Why one page instead of a policy document

A formal policy and a set of rules are two different documents, and they can happily coexist. The policy is for the institution: liability, procedures, consequences — drafted with a lawyer, long because it has to be. The rules are for the people inside: they must answer "can I paste this file here?" faster than it takes to find someone who knows. We measure a rollout with one test: stop a random person in the company and ask them to name three things that must never be pasted in, plus the person to ask. If they cannot, the document is not working — regardless of its length or who approved it.

Prefer to do it yourself? We built a free generator

Not every company needs an agency for this. In a small team sitting in one room the whole conversation fits into a single meeting — all that is missing is the document. That is why we published a free generator as part of our FlashAI product: answer eight questions and get a one-page set of rules for your team, no sign-up. The AI usage rules generator is public and asks for nobody’s contact details. We do the same thing, but with the discovery, the team conversations, the announcement and the review — the part no form can do for you.

What we do not do

This is organisational help, not legal advice. We do not issue legal opinions, we do not audit contracts with model vendors and we do not declare that after our work a company complies with any particular act — compliance depends on what actually happens to the data, and a lawyer determines it, not an agency. We handle the part where most companies get stuck: making sure the team knows what is allowed, who to ask and what to do after a mistake. If a law firm has already written your policy, all the better — then our job is to translate it into one page and communicate it.