Write down what your staff may put into AI.
Who Approved That is an AI use policy pack for a company where people are already pasting work into chatbots nobody approved. An editable policy, a rule for what may never leave the building, a register for approved tools, an incident procedure, and the one page your team will actually read.
Card payment through Stripe. Access is immediate.
- $67
- ONCE. EDITABLE, AND IT CARRIES YOUR NAME, NOT OURS.
- 8
- DOCUMENTS, WRITTEN TO BE ADOPTED IN A WEEK.
- 1
- PAGE YOUR STAFF ACTUALLY READ.
The policy question arrives after the paste, usually
Somebody in your company put a customer list into a chatbot this quarter to clean it up. Somebody pasted a contract in to have it summarized. Somebody used a transcription tool on a call that had health information in it.
None of them were being reckless. They were being efficient, with tools that are genuinely good at that, and nobody had ever told them where the line was. There was no line to tell them about.
Banning it does not work, because it moves to personal accounts on personal phones where you cannot see it at all. What works is a short written rule, a list of what is approved, and a procedure for the day somebody gets it wrong. This is those, written and ready to edit.
Who this is for
Ten to two hundred people, a real customer database, and no written answer to the question of what may be pasted into a tool your company does not control. Somebody has already done it. Most of them are not telling you.
You have a general counsel and an information security function who have already published this and trained on it. You do not need a template, you need a review, and that is a different purchase from a different kind of firm.
What is in the pack
Eight documents, editable, with your company name in them rather than ours. Written to be adopted in a week by a company that does not have a compliance department.
The AI acceptable use policy.
One page of rules, with the detail in appendices behind it. Written for people who will not read past the first page, so everything that matters is on the first page.
The data classification rule.
Four tiers and a table of what may never be pasted into a tool your company does not control. Customer records, credentials, health information, cardholder data, unreleased financials, anything under a client confidentiality clause. Specific enough to be followed.
The approved tool register.
A template, plus the eleven questions a tool has to answer before it goes on the list. Does it train on your inputs. What is the retention. Who are the sub processors. What region. Can you delete. Who at your company owns the account.
The vendor questions, short form.
What to send an AI vendor before you approve them, in an email you can copy. Six questions, and the answers that should stop the approval.
The incident procedure.
What to do in the first hour after somebody pastes customer records into a public model, in the order you do it. Containment, what to preserve, who to tell, and the questions that decide whether this is a notifiable event or an internal one.
The staff one pager.
The document that actually gets read. A yes list, a no list, and an ask first list, in plain language, on one side of one page. Everything else in the pack exists to support this.
The rollout note.
How to introduce this without your team routing around it. A policy that people quietly ignore is worse than no policy, because it produces the paperwork of control without any of it, and you stop looking.
An orientation note on where the obligations come from.
GDPR, CCPA and CPRA, HIPAA, PCI DSS, GLBA, the EU AI Act and the state laws now in force. Directional and educational, so you know which of these plausibly reaches you and who to ask. It will never tell you that you are compliant.
Card payment through Stripe. Access is immediate.
The comparison is an hour of a lawyer, and this is what you hand them
You could have counsel draft this from nothing. You know their hourly rate and we do not, so you can price that side of it better than we can.
What this pack does is change what that hour is spent on. An hour reviewing eight drafted documents is a different bill from an hour explaining what you want drafted, and you get to have the internal argument about the data classification tiers before the meter is running.
It is also the version you can adopt this week and refine later, which is worth something specific in a quarter where nobody has published anything at all.
Thirty days, and you decide
Read it. If it did not save you the work of writing this yourself, tell us inside thirty days and we refund it in full.
You decide that, not us. We are not going to ask you to send the version you edited back to prove you used it.
What people ask before they buy this
Is this legal advice, and can I just adopt it as written?
It is not legal advice and you should not adopt it unreviewed. It is a drafted starting point in plain English, built so your own counsel spends the hour editing rather than beginning. What it is safe to do immediately is publish the staff one pager, which is a house rule rather than a legal instrument.
We already banned AI tools. Do we need this?
A ban is a policy, so you have one. The question is whether it is being followed, and the honest answer in most companies is that it moved to personal phones where nothing is logged. If you would rather see it than not see it, this is the pack that gets you there.
Does it cover the EU AI Act?
Directionally. The orientation note tells you which obligations plausibly reach a company of your shape and who to ask about them. It does not classify your systems by risk tier and it will not tell you that you are compliant, because a document that says you are fine and is wrong is worse than nothing.
How long does this take to actually adopt?
The staff one pager can go out the day you buy it. The full policy realistically takes a week, most of which is the internal argument about the data tiers rather than the writing. The rollout note is about that week specifically.
Is it editable or is it a locked PDF?
Editable. A policy you cannot put your own company name and your own tier definitions into is a poster, not a policy.
This pack is educational and directional. It is not legal advice, it does not create a lawyer client relationship, and it must be reviewed by your own counsel against your jurisdiction, your industry and your contracts before you adopt it. It will never tell you that you are compliant.
Publish the one pager this week.
An editable policy, the data classification rule, the tool register, the vendor questions, the incident procedure, the staff one pager, the rollout note and the orientation on where the obligations come from.
Thirty days to decide it was worth it, and you are the one who decides.
Card payment through Stripe. Access is immediate.
$67 ONCE. IMMEDIATE ACCESS. THIRTY DAY REFUND, ADJUDICATED BY YOU.
WHO THIS IS FOR
Ten to two hundred people, a real customer database, and no written answer to the question of what may be pasted into a tool your company does not control. Somebody has already done it. Most of them are not telling you.
- $67
- ONCE. THIRTY DAY REFUND, AND YOU DECIDE.