AI tools help us draft, code and analyze faster, but anything typed into them can leave our control. This policy protects customer payment card data under PCI DSS, our designs and pricing, and our coworkers' personal information, so everyone at Example Manufacturing Co. can use AI with confidence.

• Microsoft 365 Copilot: Drafting emails and documents, summarizing meetings, and working with company files in Word, Excel and Outlook.
• ChatGPT Enterprise/Team: Drafting, brainstorming, research and code help, using your company-issued account only.

Sign in with your company account, never a personal or free account. Any other AI tool, plugin or browser extension needs approval first, even if you already use it.

• Move work off personal AI accounts and use only the approved company tools.
• Check the data tiers before pasting anything into an AI tool.
• Review every AI output for accuracy before you send, ship or build from it.
• Never let AI make final decisions on safety, quality, hiring or payments.
• Report mistakes or suspicious tool behavior right away.

To ask for a new AI tool, email ai-requests@example.com with the tool name, what you want to use it for, and what data it would touch. You will get an answer within two weeks.

If you put restricted data into an AI tool or spot a problem, tell Dana Whitfield, IT Director, right away at [IT security contact email or phone]. Fast reporting limits harm and will not get you in trouble. Violations start with a conversation with your manager; HR is involved only for repeated or serious cases.

AI use on company devices and accounts is monitored to protect company and customer data, consistent with our other IT policies.

• Check whether Microsoft 365 Copilot or ChatGPT Enterprise/Team already meets the need before approving a new tool.
• If the tool could touch payment card data, confirm it stays outside the PCI DSS cardholder data environment, or get the vendor's PCI DSS responsibilities confirmed in writing.
• Get written confirmation from the vendor on data retention, whether customer data is used for training, and where data is stored.
• Confirm the tool can be used with company accounts (not personal ones) and fits the monitoring already in place on company devices.
• Confirm the requester's manager supports the request and that a named owner and budget are in place: [cost center or budget code].

Decision: Approved  Approved with conditions  Not approved

Answer sent by (within two weeks of the request): ______________________

Dana Whitfield, IT Director owns this policy, answers tool requests, and runs the six-month review.

HR and legal have reviewed the policy before it is published.

• Dana Whitfield (IT Director) confirms in writing with Microsoft and OpenAI how Microsoft 365 Copilot and ChatGPT Enterprise/Team handle company data (retention, training on our data, access controls), then finalizes the policy and posts it at [intranet or SharePoint policy location].
• Dana Whitfield emails the policy to all staff in Ohio and Indiana with a request to read it (under five minutes) and acknowledge it by [acknowledgment due date], using [acknowledgment tool, e.g. a Microsoft Forms quiz or HR system].
• Managers in engineering, sales, the plant floor and finance confirm their teams have moved drafting and code work off personal or free AI accounts and onto Microsoft 365 Copilot or ChatGPT Enterprise/Team, and that any browser writing extensions not on the approved list are submitted to ai-requests@example.com for review.
• Dana Whitfield tracks acknowledgment rates weekly by department, sends reminders through managers to anyone outstanding after [number] days, and adds the policy and the 10-minute training to new-hire onboarding.

• Acknowledgment and training completion rates by department and site, with follow-up on any team below [target percentage].
• Whether personal or free AI accounts and unapproved extensions are still in use on company devices, based on monitoring data, and whether those users now have access to the approved tools.
• Any incidents involving payment card data or other sensitive information in AI tools, how they were handled, and whether the PCI DSS-related rules need clearer examples.
• Requests received at ai-requests@example.com, decisions made, and whether vendor terms for Microsoft 365 Copilot and ChatGPT Enterprise/Team have been reconfirmed in writing for any changes.