Turn your AI policy into three rules your team will remember
The AI policy exists, but a colleague still has to search twelve pages to find out which account to use. Policies are written for auditors, insurers, regulators, a nervous executive and the people doing the work, usually in that order.
What you'll make
a short card of three second-person rules, each with its policy section numbers, plus a coverage table showing every duty is still there, ready for the policy owner to approve.
What you'll need
the current version of your AI policy and anything it links to, a ChatGPT, Claude, Gemini or Copilot chat in your work account that you’re allowed to use for the policy text, the name of the policy owner, and about an hour.
Example result.
Harbrook AI Standard v1: three rules for the operations team. Draft, awaiting policy-owner review.
1. Work account, listed tools only. Use the tools in Appendix B, signed in with your Harbrook account. Nothing confidential, personal or non-public financial goes anywhere else: not a personal account, not the free version. (3.2, 4.2)
2. You are the author. You’re accountable for what comes out. Check it before it goes outside, and never use it as the record of a decision. (4.5, 5.1)
3. Four things need asking first. Hiring, performance, discipline or anything affecting one person: ask the People Director. Customer commitments, regulators or anything published: ask your Head of Function. Before you use AI for it, not after. (6.3, 6.4)
Not sure which applies? Ask Dana Okafor before you paste.
The three rules are a card, not a replacement for the policy. They point people to the right action and link back to the full text.
1. Find the current policy and who it covers
Open the official copy and note its title, version, effective date and owner. Check who it applies to: a rule covering contractors and agency workers shouldn’t quietly become an employee-only card. If the list of permitted tools lives in an appendix, link to that live list rather than copying names that will go out of date.
Pick one audience and their real work, such as an operations team writing internal updates and supplier emails. If the policy isn’t cleared for your AI account, do the extraction by hand.
Why this works: three rules can only be right for one audience at a time.
What you should see: the policy’s version and owner, the audience, and any linked documents you’ll need.
2. Pull out the duties before shortening them
Extract the requirements relevant to [audience and work] from the policy below.
For each, give: the exact wording and section number; who it applies to; the required or prohibited action; conditions, exceptions and timing; any approval role; and any linked document needed to interpret it.
Include duties about records, reporting, review and escalation, even if they don't mention typing or uploading. Do not infer that something is allowed because it isn't prohibited. List ambiguities and missing linked material separately. Extract only.
POLICY
[policy text with title and version][audience and work] is your audience from step 1, and [policy text…] is the pasted policy.
Why this works: exact wording keeps “only after approval” attached to its rule. Scope and governance clauses (who reviews the policy annually) usually drop out here, because they don’t change what anyone does on a Tuesday afternoon.
What you should see: a handful of operative duties, typically four to nine from a long policy, each with a section number. Read the policy yourself to check none are missing.
3. Write three rules in plain second person
From the checked requirements below, write three rules for [audience] under these headings: use the right account and information; check and handle the result; ask before you proceed. Use second person and no more than 35 words per rule. Put section numbers after each rule.
Keep every duty, exception, approval role and timing condition; if one doesn't fit, say so rather than dropping it. Do not add a requirement or widen a permission. Then show a coverage table: each source requirement, the rule that covers it, and anything left out or unclear. Mark the card "Draft, awaiting policy-owner review".
CHECKED REQUIREMENTS
[the extraction from step 2]Add one line under the rules: “Not sure which applies? Ask [named person] before you paste.” A named person, not a mailbox.
Why this works: the word limit makes the card usable; the coverage table keeps the detail that didn’t fit visible to the reviewer instead of quietly lost.
What you should see: three short rules a person could recall without looking, and a table where every requirement has a home.
4. Check the meaning and get the owner’s approval
Read the card beside the policy in both directions: does every rule have a source, and is every duty covered? Look hardest at must, may, only, before and unless. Watch for helpful additions too. If you’d like an extra check, label it as a proposal for the owner, not as policy.
Send the card and coverage table through your normal review route and ask the owner to confirm accuracy, completeness and where the card may be used. Silence isn’t approval. An approved three-line card is an asset; an unapproved one circulating in a channel is a problem with your name on it.
Why this works: the owner can check a mapped draft quickly, and their sign-off is what makes the card usable.
What you should see: a signed-off card, or a list of specific corrections from the owner.
Check the result
- Each rule has a section number you can find in the policy.
- Every operative duty appears in the coverage table against a rule.
- Conditions and timing (“prior”, “only”, “before external issue”) survive in meaning.
- Nothing new has been added as if it were policy.
The usual failure: shortening moves a condition. “Prior approval for AI use” becomes “get approval before you send”, which is a different rule: the first stops you starting, the second only stops you finishing. Spot it by reading each “before” or “only” in the card against the clause it cites. Then:
The card changes the meaning of section [number]. The source says "[exact wording]". Revise the affected rule to keep its scope, condition and timing, within the word limit. Do not drop another duty to make room. Update the coverage table and keep the review label.[number] is the section and [exact wording] is its text.
Worked example: the Harbrook standard
Fictional example. The policy extract:
HARBROOK GROUP — AI STANDARD, version 1
3.1 Applies to colleagues, contractors and agency workers using generative AI tools for Group business.
3.2 Approved tools are listed in Appendix B and provisioned through the Group identity account. Personal accounts or consumer versions must not be used for Group work.
4.2 Confidential information, personal data and non-public financial information must not be entered into tools outside the approved list.
4.5 Users remain accountable for output accuracy. Output must be reviewed before external issue.
5.1 AI output must not be relied upon as the record of a decision. Decisions must be recorded under the Records Standard.
6.3 AI use for recruitment, performance management, disciplinary matters or decisions materially affecting an individual requires prior approval from the People Director.
6.4 AI use involving customer contractual commitments, regulatory submissions or public statements requires prior approval from the relevant Head of Function.
9.1 The AI Governance Forum reviews this Standard annually.Six clauses are operative: 3.2, 4.2, 4.5, 5.1, 6.3 and 6.4. Clause 3.1 is scope (it goes in the card’s title line) and 9.1 is governance (it stays in the coverage table).
- The failure. The first card’s rule 3 ended “…ask your Head of Function before you send it.” Clauses 6.3 and 6.4 require approval before the AI use, not before sending.
- The repair. The correction prompt on 6.4 changed the ending to “Before you use AI for it, not after”, as in the example result.
- The judgement call. Clause 5.1 became half a sentence in rule 2 rather than a fourth rule. That’s arguable, so the coverage table flags it for the owner. The owner also needs to supply the live links to Appendix B and the Records Standard.
Task kit for this job: Download (ZIP) · Reusable instructions
Go deeper
Optional training: Put the card where the work happens
Nobody navigates to a policy summary. They arrive at a task. So the card works best where people already are when they use AI: pinned at the top of the channel where people ask AI questions, in the onboarding note for new starters, and, most usefully, in the description of the shared project, Gem or prompt-library entry, where someone sees it while doing the thing.
Say the three rules out loud in a team meeting once, in your own words, then leave them alone for a quarter. Watch what people ask the named person: the questions that keep coming are where the policy is unclear, and that’s useful evidence for the owner.
Optional training: When three rules aren't enough
If a role genuinely has more than three load-bearing duties (a clinical team, a regulated adviser, anyone handling special category data), don’t compress harder. Write three rules per role and accept several cards. Compression is the technique; brevity isn’t the goal.
If the policy is so vague that nothing survives step 2 (“use AI responsibly and in line with our values”), the honest output isn’t three rules. It’s a short list of questions nobody can currently answer, which is more useful to send upwards than a confident summary of nothing. For a full plain-English rewrite rather than a card, see Rewrite a dense internal policy into something people will actually read.
Optional training: Test the card on three situations
Once the card is approved, give a colleague three short fictional situations and ask which rule applies and who to ask: “a manager wants AI to draft a disciplinary letter”, “you want to summarise a public supplier brochure”, “you’d like to paste a customer’s complaint into the free version”. You’re checking the decision, not whether they can repeat the wording. If they’re unsure, go back to the policy and the owner rather than removing an exception. The European Commission’s AI literacy Q&A discusses fitting learning to people’s experience and context.