Write an employee-facing AI use policy short enough that people actually read it before ignoring it

Write a short, plain-language employee-facing AI use policy — the kind an employee will actually read in three minutes, not a legal document nobody opens past the title.

APPROVED TOOLS AND USE CASES
ChatGPT Enterprise (company account) approved for drafting, brainstorming, and summarizing internal documents; no approval yet for customer-facing chatbots.

HARD DATA RED LINES
Customer names paired with account numbers, any unreleased financial results, source code from the payments repository.

DISCLOSURE EXPECTATIONS
Any customer-facing email drafted with AI assistance must still be personally reviewed and sent by the employee, no auto-send.

WHAT HAPPENS IF SOMEONE VIOLATES THIS
First accidental red-line violation: report it immediately, no punishment, treated as a training moment. Repeated or deliberate violations go to HR.

WRITING RULES
Write this as short numbered rules an employee could actually remember, not paragraphs of legal prose — each rule should be one or two sentences, plain language, no defined-terms formality. Lead with what's allowed and encouraged before what's prohibited; a policy that opens entirely with restrictions reads as adversarial and gets skimmed defensively rather than actually absorbed. State every data red line as a concrete example of what not to paste into a general AI tool, not an abstract category — "customer social security numbers or full payment card numbers" lands with an employee in a way "personally identifiable information" does not, because it's instantly checkable against something they might actually be about to do. State the disclosure rule as a specific action (label AI-assisted content, note it in a specific field, tell your manager) rather than a vague expectation to "be transparent about AI use." State consequences honestly but without hostility — what actually happens on a first violation versus a repeated one, since a policy that implies immediate termination for any AI mistake trains people to hide mistakes rather than report them.

WHAT NOT TO DO
Do not write this in a formal legal register with defined terms and "whereas" clauses — that register signals "skip this" to most employees and defeats the actual goal, which is behavior change, not legal formality. Do not state that this policy fully satisfies any specific regulatory requirement — if regulatory compliance is a goal here, note that legal has reviewed this for that purpose only if I've told you that review already happened; otherwise, leave that claim out entirely.

OUTPUT FORMAT
A short policy: title, one-paragraph "why this exists" framed positively, a numbered "what's encouraged" section, a numbered "hard red lines" section with concrete examples, a short disclosure-rule section, and a brief, non-hostile consequences section. Total length under 500 words. Close with a line noting this is a draft pending legal review, and that it must be approved by a qualified lawyer or compliance officer before being published or enforced as an actual company policy.