Generative AI Policy for Employees

A generative AI policy for employees should tell staff how to use text, image, audio and code generation in ordinary work. The difficult part is rarely the instruction to “use AI responsibly”. It is deciding what may enter a prompt, what needs checking, when a draft can leave the organisation and what to do when an apparently helpful answer introduces an unsupported claim.

For a Saudi employer, a useful policy combines a short employee rule set with task examples in clear Arabic and English where both languages are used. It should identify the approved environment and the people who can answer questions. The policy must also acknowledge real working conditions: incomplete notes, approaching deadlines, shared documents and managers who may ask employees to move faster than the review process allows.

The proposed clauses below are a starting point for organisational approval, not a statement that every employer is legally required to adopt this wording. Saudi Arabia's national portal describes separate generative AI guidance for government and public audiences. Select the guidance and obligations relevant to your organisation. This page focuses on employee behaviour; the wider AI acceptable use policy can cover predictive tools and automated actions as well.

Give employees a one-minute decision sequence

Put the daily decision sequence before definitions. First, check that the tool and company account are approved for the task. Second, check that the information is allowed in that environment. Third, decide who will review the result and what must be verified. Fourth, identify the audience and any separate approval before release. If a necessary answer is missing, use the named support route or complete the task through an approved alternative.

This sequence should fit beside the tool catalogue or inside the employee intranet. It is not a substitute for specialist assessment, but it prevents the common assumption that an enterprise subscription makes every prompt acceptable. Link to an owner who can resolve uncertainty rather than sending employees through several policy documents without a decision point.

Use plain distinctions: a source fact, an AI suggestion, a verified correction and an authorised commitment are different things. A polished paragraph may combine all four without showing the boundaries. The employee policy should make staff responsible for recognising those boundaries in the work they submit, while ensuring that they have the time, access and expertise to check the relevant material.

Adapt eight practical employee policy clauses

The following clauses are original proposed wording. Replace the organisational roles and reference locations with actual approved arrangements. Have the relevant policy, privacy, security, legal and employee-relations owners review them. Adoption requires a workable process around the words, including approved tools, review capacity and a way to request help.

1. Approved environment. Use generative AI for work only through the accounts, features and task permissions listed in our approved catalogue. A personal subscription or a newly added feature is not covered merely because it uses the same product name.
2. Necessary inputs. Include only information permitted for the approved task. Do not upload full correspondence, recordings or attachments when a smaller approved extract is sufficient. Ask the information owner when the source boundary is uncertain.
3. Source-grounded checking. Verify factual statements, references, calculations and material omissions against reliable sources before relying on the result. Do not treat an AI-generated citation as proof that a source exists or supports the claim.
4. Responsibility for release. The employee and business approver retain their normal responsibilities for documents and communications. AI-generated wording does not authorise a promise, price, technical assurance or external publication.
5. Transparent working records. Record material AI assistance where our task procedure requires it, including the approved tool and the review performed. Follow client or professional disclosure requirements applicable to the work.
6. Protected identities and materials. Do not create misleading representations of real people, projects or approvals. Use protected, confidential or third-party material only within the rights and permissions confirmed for the activity.
7. Unexpected results. Report possible disclosure, harmful or materially misleading output, or an unintended action through the designated channel. Preserve relevant evidence using approved handling arrangements rather than circulating the prompt widely.
8. Scope changes. Request review before adding new information sources, sharing an assistant, enabling automatic messages or using a drafting tool to make consequential decisions. Existing permission covers the recorded task, not every capability the product offers.

Place practical examples beside the clauses, rather than adding vague statements such as “always exercise judgement”. An employee should know what evidence counts as checking and what belongs with a specialist. For detailed approval mechanics, connect the policy to the AI intake and review process.

Worked example: workshop notes become a client proposal

Consider a fictional engineering office preparing a bilingual proposal after a client workshop. The approved task is to turn an authorised summary of agreed requirements into a draft structure. The assistant may help organise the text. It is not authorised to receive the full recording, disclose internal margin notes or invent a technical commitment.

The coordinator has three source items: an approved requirements summary, internal notes about commercial flexibility and an unverified recollection of a possible delivery date. These items should not be combined into one prompt simply because they concern the same meeting. The first is within the proposed source boundary. The second has a separate confidentiality purpose. The third needs confirmation before it becomes a promise.

Illustrative review of an AI-assisted proposal

Draft element	What the reviewer finds	Required correction
Scope paragraph	Mostly follows the approved summary but omits a site-access dependency	Restore the dependency and link it to the source
Delivery statement	Turns a possible date into a guaranteed completion date	Remove the guarantee and obtain the authorised scheduling position
Technical reference	Names a document the reviewer cannot locate	Remove or replace it with a verified supporting source
Arabic version	Uses a stronger commitment than the approved English wording	Align the meaning and obtain bilingual review

The coordinator records the corrected draft and the checks performed. The commercial approver authorises the final proposal through the normal process. A clean-looking first draft does not eliminate that approval. Equally, the use of AI does not make every sentence untrustworthy; the reviewer focuses on the claims, omissions and commitments that matter to this document.

If the assistant needs more information, the coordinator does not automatically upload the recording. The request returns to the source owner to decide whether an approved extract can answer the question. That preserves the distinction between a useful drafting workflow and a broader meeting-data processing activity.

Explain what verification looks like for different outputs

For factual writing, require traceable source support for consequential claims and a check that qualifications survive summarisation. A statement that a component is “available subject to confirmation” must not become “available”. A reference should be opened and read for the relevant claim, not accepted because the title sounds plausible. If the source cannot be verified, remove the claim or mark the uncertainty in the authorised way.

For calculations, reproduce the important arithmetic using an appropriate method and verify the assumptions. A correct total can still be based on the wrong period or unit. For translations, check meaning, scope, names, numbers and commitments; linguistic fluency alone is insufficient. The person checking a specialist text needs relevant subject knowledge or a route to someone who has it.

For code or formulas, apply the organisation's normal review and execution controls. A generated script can change files or contact services even if the employee intended only to inspect data. For images and audio, distinguish creative illustration from representations of real events or people. These task-specific checks belong in short work instructions linked from the employee policy.

Set rules for meetings, recordings and shared assistants

A meeting assistant can process more than the final minutes. The proposed workflow may include audio, transcripts, participant details, prompts, summaries and support diagnostics. Before making it an employee default, the responsible owners should determine which meetings are included, what notices or permissions apply, who can access the materials and how long each copy is kept.

The employee instruction should be concrete: use the approved meeting feature only for the listed meeting types, follow the required notice procedure and stop or seek advice when the discussion moves outside scope. Do not suggest that an employee can solve every privacy question by making a quick verbal announcement. The organisation must establish the applicable process before staff are asked to use it.

Shared assistants need an additional check. A personal draft may become accessible to a team when the employee shares a workspace or adds a knowledge source. Define who can publish an assistant, approve its sources and maintain its instructions. The governance of purchased and embedded AI should cover the feature configuration behind the employee-facing rule.

Keep bilingual obligations equal in meaning

If the policy is issued in Arabic and English, review the two versions as one operational rule set. Words expressing permission, obligation, uncertainty and prohibition must carry the same force. A softer translation of “must obtain approval” can create a different process, while a stronger translation of “may propose” can incorrectly grant decision authority.

Test examples in the language employees actually use for work. In the proposal case, the bilingual reviewer checks whether a condition, exclusion or provisional date changed meaning. Product interfaces may remain in English, but the employee instructions should explain the actions clearly in Arabic. Preserve exact product labels only where staff need them to find the relevant setting.

Assign an owner to update both versions together. A changed data permission should not appear in one language while the other continues to describe the old rule. Keep a short change note explaining what employees should do differently. This is particularly useful when a supplier enables a new feature without changing the familiar product interface.

Define disclosure without turning it into a ritual

Internal working records and external disclosure serve different purposes. An internal record may help a reviewer understand how a draft was prepared. A client-facing disclosure may be required by the engagement terms, professional context or an applicable rule. The policy should identify those situations through the responsible owners instead of imposing one unsupported universal statement on every document.

For a material AI-assisted proposal, a useful internal record can state the approved tool, task, source boundary and checks completed. It need not preserve every exploratory prompt indefinitely. Retention and access should follow the organisation's documented requirements, especially where prompts contain personal or confidential information.

Do not let disclosure replace verification. Writing “AI assisted” at the bottom of a document does not make a false claim acceptable or transfer responsibility to the recipient. The approver still needs a document that meets the normal standard for the work. Likewise, avoiding disclosure where required cannot be justified by extensive human editing.

Support employees when the policy blocks a real task

A policy that prohibits uploading a certain file should explain the available alternative. Staff may be able to use an approved extract, a company-controlled environment, a human review route or the ordinary workflow. If none is available, the owner should record the unmet need and decide whether it warrants a new approved use.

Managers must not pressure employees to bypass restrictions while still holding them responsible for compliance. Provide an escalation route for conflicting instructions. The issue may be a poorly designed workflow, insufficient review capacity or an unclear ownership decision. Treat those as management problems that need resolution, not as reasons for staff to improvise quietly.

The shadow AI governance response can use this information to improve approved services. Request trends are useful evidence: repeated requests for a bilingual document-drafting tool may reveal a genuine gap. The response should assess the task and information involved rather than approving a consumer account solely because many employees already use it.

Train people on the mistakes they are likely to make

Use short exercises drawn from actual roles. A coordinator can identify an unsupported delivery commitment; a manager can decide whether a new connector changes an approval; a reviewer can compare Arabic and English conditions. Ask participants to show the action they would take and where they would record it. A quiz about what generative AI means is insufficient for these decisions.

Include an exercise where the output is mostly correct but omits one material condition. This tests whether staff read critically rather than looking only for obvious hallucinations. Include another where the correct response is to stop and ask for a source, even though the text is polished. Reward accurate escalation as a successful outcome.

Connect the exercises to the AI training and awareness programme and capture the issues they reveal. If employees cannot locate the approved catalogue, improve access to it. If reviewers lack subject expertise, change the review assignment. Training should expose weaknesses in the operating arrangement as well as build individual skill.

Give the reviewer a compact source-and-change note

For a consequential document, ask the author to hand over a short note identifying the approved inputs, statements added by the tool, unresolved points and intended recipient. The purpose is to make review efficient. A reviewer should not have to guess whether an apparently precise delivery date came from an agreed plan, an employee's assumption or the generated draft.

In the engineering proposal example, the note would identify the workshop requirements, preserve the unresolved site-access dependency and flag the proposed date as unconfirmed. It would also state that internal margin notes were excluded from the input. The reviewer can then check the commitments in both languages against the same factual boundary.

This note need not preserve every exploratory prompt. Select the information needed to understand the final business document and follow the organisation's records rules. For a routine low-consequence drafting task, ordinary review may be enough; for a customer commitment, the source-and-change note helps expose uncertainty before release.

Provide a correction path after a generated draft is sent

Employees should know whom to contact if they discover that an AI-assisted message contained an incorrect fact, omitted condition or unintended disclosure. The immediate task is to prevent further reliance, establish the affected recipient and preserve the necessary evidence through the approved route. Quietly editing an internal copy does not correct the version already received by a customer.

Give the responsible business owner authority to coordinate the appropriate correction, involving privacy, legal or security specialists when the circumstances require them. Record which statement was wrong, what was corrected and whether other documents reused it. Feed the lesson into the specific drafting exercise that failed, rather than adding a vague instruction to “be more careful” to every employee's policy.

Maintain a policy employees can trust

Publish the effective version, owner and help route in a stable location. Retain superseded versions for the appropriate record purpose and explain changes in plain language. Staff should not need to search old email announcements to determine whether a feature remains approved.

Review incidents, uncertain cases and changes in supplier functionality together. A new shared-memory feature, meeting integration or automatic publishing capability may require revised instructions even when ordinary drafting remains permitted. Update the relevant task entry rather than treating every change as a reason to rewrite the entire policy.

Bring a few real employee workflows and existing rules to a governance setup discussion about employee generative AI use. Through AI governance setup, those examples can become clear policy clauses, practical review instructions and a support process that employees can actually use. The test is whether a staff member can produce useful work while preserving the information and decisions entrusted to them.