An AI use policy should name the approved tools, list the kinds of information that may never go into them (client identifiers, financial data, health records, anything under a contract), require a person to review AI output before it is used or sent, and say who owns the policy and how often it is reviewed. CICOR Marketing drafts the policy as part of the enablement program. Your attorney reviews it before leadership signs it.