Make the standard usable
A team standard should help someone decide what to do at the moment of use. Start with its audience, approved tools and named owner. Define a small set of permitted examples, prohibited uses and cases that require approval. Use familiar scenarios from the team’s work so the rules can be applied without interpreting abstract principles.
Assign responsibility clearly. The person using AI remains responsible for checking the work they rely on or share. Name the business owner for each approved use, the contact for security or privacy questions and the route for reporting a mistake. NIST’s framework treats governance as a continuing function, so ownership should extend beyond the launch announcement.
Draw a bright line around information
List what staff may enter and what they must keep out of unapproved tools. Cover personal data, client information, confidential business material, credentials, unpublished plans and intellectual property in language that fits your organisation. Tell people where to work when an approved use needs protected information, and who can authorise access.
Official guidance from the Australian Cyber Security Centre recommends training staff on what data can and cannot be entered, as well as how far outputs may be relied upon and how they must be validated. Tool settings, contracts and data handling can differ, so keep an approved-tool register with its owner, intended uses and review date.
Define the human check
State that plausible language is not evidence. Require users to verify facts against trusted sources, check calculations, review tone and identify missing context. For higher-consequence work, specify a qualified reviewer and prevent automatic external action. The UK government’s published guidance warns that generative AI output can contain bias or misinformation and should be checked and cited appropriately.
Disclosure should follow the use. A private brainstorming aid may need a lighter record than content sent to a client or analysis supporting a decision. Give examples of when staff should note the tool used, preserve source references or keep an approval record. Explain which decisions cannot be delegated to a system.
Train, observe and update
Launch the standard through short exercises: identify unsafe input, verify a confident but unsupported answer and escalate an uncertain case. Provide a place to ask questions without blame. Track recurring confusion, incidents and useful new cases rather than measuring adoption by the number of prompts.
Review the standard whenever an approved tool, workflow or information source changes, and on a regular cadence even when nothing obvious has changed. The Australian guidance also recommends monitoring and periodic health checks. Record revisions, tell staff what changed and retire instructions that no longer match the tools they use.
Keep the working version short enough to revisit. A useful structure is: purpose, approved tools, allowed uses, restricted information, required checks, disclosure, escalation, ownership and review date. Link longer security or privacy material where needed. The standard succeeds when a colleague can apply it during a real task and knows where to ask when the answer is unclear.