A practical policy for actual AI use at work
Define which tools and tasks are approved, which data needs protection, who reviews outputs, and how employees report incidents. The policy should match your operating practices and the rights of the people it covers. It cannot make an unimplemented control true.
The builder separates a working draft from a policy prepared for adoption. Unresolved jurisdiction questions or incomplete implementation keep the document in draft form without adoption or acknowledgment signature fields.
Start with every work location
A primary state is an administrative detail. It does not decide which laws govern all remote employees, applicants, vendors or customers. Record actual locations, activities, sector requirements and exclusions. Independently assess each selected overlay instead of relying on a headquarters address.
Consumer privacy laws and employment protections have different definitions and exclusions. An employment-data exclusion from a consumer privacy statute does not remove separate workplace, biometric or security obligations.
Verify tools, inputs and outputs
List each approved vendor, account tier, deployment, task and permitted data. Record the actual training-use terms, retention and deletion settings, access controls and integration limits. A business-plan label alone does not establish these protections.
Require appropriate human review of factual accuracy, confidentiality, discrimination risks and third-party rights before using outputs. A policy does not assign intellectual property or guarantee copyright in generated material.
Personnel decisions and monitoring need separate controls
Describe actual tools, purposes, data, affected people, human decision authority, retention and rights channels. Required notices, consent, audits and worker consultation must be completed separately before the relevant activity. Turning a permission off prohibits that use under the policy; it does not certify historical practices.
The policy preserves lawful wage and working-condition discussions, protected concerted activity, reporting to government agencies and trade-secret whistleblower immunity. An employee acknowledgment records receipt and does not supply monitoring consent, biometric consent, a digital-replica authorization or an IP assignment.
Selected legal requirements to check
NYC: Covered employment tools require an independent bias audit, publication and applicable advance notice. The internal policy is not that notice.
Illinois: Employment AI discrimination and notice rules are separate from the recorded-video-interview requirements for positions based in Illinois. Those interviews require their own advance explanation and consent, with sharing and deletion controls.
Colorado: SB 26-189 replaced the former framework. Assess the covered decision, January 1, 2027 applicability, advance disclosure, adverse-outcome notice, correction and review duties.
California: Employment discrimination requirements, CCPA ADMT coverage and digital-replica provisions require separate analysis. CCPA ADMT compliance begins January 1, 2027 for covered uses.
Maryland and Texas: Maryland interview facial-template consent requires a separate signed statutory waiver. Texas AI discrimination and specified disclosure duties depend on the actual activity and role.
EU: Classify the actual system and role. Not every workplace tool is high-risk. Check the current AI Act timetable and already applicable prohibitions, and separately assess GDPR processing and automated-decision restrictions.
These selected provisions are not a completed survey of all federal, state, local and international requirements.
California workplace changes and operative dates
An AI-use policy is not the separate post-decision notice required for covered discipline or termination. SB947 becomes operative July 1, 2027. Covered discipline and termination require human corroboration where ADS is primarily relied on, a separate postuse notice when communicating the decision, and a data-description request process. CCPA coverage is a separate assessment.
AB1331 takes effect January 1, 2027 and restricts workplace bathroom surveillance with specific device and entry/exit provisions. SB951 adds technology-displacement information to already-required Cal/WARN notices from January 1, 2027. It does not create a universal 90-day AI layoff notice. Review actual scope, exceptions and delivery; a future implementation plan is not proof of current operation.
Prepare the policy for adoption
- Map the people and work. Identify covered personnel, actual work and hiring locations, approved tasks and responsible administrators.
- Verify tools and data. Record vendors, deployments, retention and training settings, permitted data and incident-reporting routes.
- Assess consequential uses. Describe actual hiring and monitoring controls, meaningful human authority, notices, audits and rights channels.
- Review before adoption. Resolve jurisdiction applicability, confirm implementation readiness and complete separate required notices, consents and worker consultation.
Primary sources
- Protected employee rights — NLRB
- Trade-secret immunity — 18 USC 1833
- NYC automated employment tools
- Illinois Human Rights Act §2-102
- Illinois AI Video Interview Act
- Colorado SB 26-189
- California final ADMT regulations
- California Labor Code §927
- Maryland interview facial templates
- Texas HB 149 enrolled text
- EU AI Act timetable
- GDPR automated decisions — Data Protection Commission
- California SB947 chaptered law
- California SB951 chaptered law
- California AB1331 chaptered law
- California Governor enactment confirmation
- California statutory effective dates