How to Create AI Guidelines for Your Organization

Begin with a map of real work

Do not draft the guidelines from a blank page in a management meeting. First, ask staff how they already use AI or would like to use it. Record each proposed use in a simple inventory with these fields:

• The task being performed.
• The information entered into the tool.
• Who will receive or rely on the output.
• What could happen if the output is wrong or exposed.
• The tool currently being used.
• The person responsible for the final result.

A Nigerian secondary school may discover that teachers want help preparing lesson plans, while administrators want to analyse student results. Those uses cannot share one rule: the first may involve general teaching material, while the second could expose children’s personal records.

A small consulting firm may use AI to format public tender documents, draft proposals from confidential client notes and research unfamiliar industries. Again, each activity has a different risk. Mapping actual work prevents the guidelines from becoming a collection of abstract warnings.

Turn every use case into one of three lanes

A traffic-light system gives staff an answer without requiring them to interpret a long policy. Classify the inventory before writing detailed clauses.

Red does not always mean that the underlying task can never involve AI. It may mean the organization needs a private environment, a data protection assessment, legal review or a purpose-built system before proceeding. Write that approval route clearly so employees do not have to guess whom to contact.

Build the rulebook around seven questions

1. Who and what do the guidelines cover?

Define whether the rules apply to employees, contractors, interns, volunteers, students and vendors. Cover generative chatbots, image and audio generators, coding assistants, automated decision systems and AI features embedded inside familiar software.

State that using a personal account or device does not remove the rules when organizational work or data is involved.

2. Which tasks are permitted?

List your green, amber and red activities. Avoid promising approval for an entire department. A human resources team might use AI to rewrite a job advert but not to reject applicants automatically.

Sample rule: Staff may use approved AI tools for green activities. Amber activities require the controls listed in the use-case register. Red activities must not proceed without written authorization from the designated owner.

3. Which tools are approved?

Keep tool names in a separate register rather than hard-coding them into the main guidelines. Tools, contracts and features change faster than governance documents.

For each approved tool, record permitted users, permitted data categories, required account settings, prohibited features, tool owner and review date. “Available online” is not the same as “approved for work.”

4. What data may be entered?

Connect the AI guidelines to your information-classification system. A workable model is public, internal, confidential and restricted. Restricted information may include passwords, identity documents, bank details, payroll records, health information, private client files and identifiable student records.

For Nigerian organizations, AI use involving personal data should be reviewed against the Nigeria Data Protection Act 2023 and applicable guidance from the Nigeria Data Protection Commission. The Act also addresses decisions based solely on automated processing where they produce legal or similarly significant effects. Your data protection officer or adviser should examine high-risk uses instead of treating the AI document as a substitute for compliance work.

Include data-minimisation instructions. Removing names is useful, but it is not enough if the remaining details can still identify a customer, patient, employee or student.

5. Who checks the output?

Make review proportionate to consequence. A spelling suggestion may need a quick check. A financial calculation, legal statement, examination resource, safety instruction or customer promise requires a qualified person to verify the relevant facts and approve release.

The guidelines should say that the human reviewer owns the final decision. “The AI produced it” is not an acceptable explanation for publishing false information or taking harmful action.

6. When should AI use be disclosed?

Do not demand a declaration for every corrected sentence. Require disclosure where it affects trust, consent, contractual obligations or interpretation. Examples include synthetic audio or images representing real events, customer-facing bots, assessed academic work and reports in which AI generated a substantial part of the analysis.

7. What must be recorded or reported?

For amber and approved high-risk uses, retain useful metadata: purpose, tool, data category, owner, reviewer, date and approval. Do not create a new privacy problem by copying sensitive prompts into a general spreadsheet.

Your incident procedure should tell users to stop the activity, preserve relevant records, alert the designated privacy or security contact, correct or withdraw affected output and follow the organization’s existing breach or complaint process.

Approve tools with questions, not popularity

Before adding a product to the approved register, ask:

• What happens to prompts, uploads and generated content?
• How long is submitted information retained, and can it be deleted?
• Can organizational data be used to train or improve a model?
• Where is data processed, and which subcontractors may receive it?
• What access controls, administrative logs and security options exist?
• How will the vendor communicate material product, model or contract changes?
• Do the licensing terms fit the organization’s intended commercial or educational use?
• Can the organization export its records and stop using the service without losing essential work?

The NIST AI Risk Management Framework offers a useful voluntary structure built around governing, mapping, measuring and managing AI risk. Its generative AI risk profile can also help larger organizations develop more detailed assessments.

Name owners before publishing the document

A guideline with no owner becomes an abandoned PDF. Assign an executive sponsor, a policy owner, a tool-register owner and contacts for privacy, security and legal questions. Each amber or high-risk use case should also have a business owner who understands the task and its consequences.

A ten-person company does not need an “AI council.” One person may hold several roles, but each responsibility must still have a name. Staff should know where to request a new tool, report a mistake and challenge an AI-assisted decision.

Pressure-test the draft with realistic scenarios

Give the draft to people who were not involved in writing it. Ask them to classify scenarios such as these:

• A teacher enters a class list and individual scores into a free chatbot. The data should not be uploaded to an unapproved service; an anonymised method or assessed school system is safer. Schools developing broader safeguards can explore practical AI support for schools.
• An NGO summarises a report already published on its website. This is likely green if a person checks the summary before reuse.
• A recruitment team asks an AI system to rank CVs and reject candidates. This requires formal review, privacy safeguards, documented criteria and meaningful human decision-making.
• An online store drafts WhatsApp replies from its published returns policy. This may be amber, provided staff exclude payment and customer details and approve each reply.

If two sensible employees reach opposite answers, the guideline needs clearer wording or another example.

Use a four-week rollout instead of a grand launch

1. Week one: Inventory uses, data categories and owners.
2. Week two: Classify the uses and draft the seven core rules.
3. Week three: Review tools, privacy obligations, contracts and high-risk cases.
4. Week four: Pilot the guidelines with one team, revise unclear sections, train staff and publish the approved tool register.

Training should use the organization’s own scenarios. Ask staff to make decisions, not merely click through slides. Provide a one-page decision card showing the three lanes, restricted data, approved-tool location and incident contact.

Final publication checklist

• Are permitted, conditional and prohibited uses unmistakable?
• Is restricted information defined with relevant examples?
• Can users find the current approved-tool register?
• Does every consequential output have a named human owner?
• Are disclosure, recordkeeping and incident rules practical?
• Have privacy, security, legal and operational reviewers approved the document?
• Is there a fixed review date and an update trigger for incidents, regulatory changes or major tool changes?

The best AI guidelines do not attempt to predict every new model. They establish durable decision rules: classify the task, protect the data, use an approved system, match review to consequence and keep a human accountable.

Start with the uses your organization has today, close the most serious gaps and improve the document through real cases. For additional practical material, visit the Tochukwu Tech and AI Academy resource library.