HIXORGenerative AI Rules at Work: The Minimum Set for a Small Company
Key points
- The rules do not need to be long. Decide five things first: which tools may be used, what must never be entered, who checks outputs, how personal information is handled, and who to contact when something goes wrong
- Japan's AI Business Operator Guidelines (MIC/METI) likewise expect users not to input confidential information inappropriately, and to use outputs with an understanding of their accuracy and risks
- A ban-only rule creates "shadow AI" — staff using personal accounts out of sight. Provide an approved path first, then draw the prohibited line
- Rules are not finished once written. Review them about every six months, and whenever the tools in use change
Official sources
(Lead) "AI rules at work" sounds like a policy binder. In a small company, a long rulebook will not be read, let alone followed. This guide covers the minimum five decisions, and the shape of a one-page document that actually works.
Why start with the minimum
Japan's AI Business Operator Guidelines (MIC/METI) assign duties to businesses that *use* AI as well: follow the provider's terms of use, understand the accuracy and risks of outputs, and do not input personal or confidential information inappropriately. Translated into company practice, that is the following five items.
The five rules to decide first
1. Approved tools — Name the services staff may use, such as a company-provided business plan. Company information is not handled anywhere else2. What must never be entered — Customer and personal information, unreleased business information, IDs and passwords, contracts with real names (details in "Before You Paste Company Information into an AI Chat")3. Who checks outputs — AI answers are drafts. Anything external, and any figures, are checked by a person before use, and that person owns the result4. Personal information — Customers' personal information goes only into tools approved for work5. Who to contact — If confidential information is entered by mistake, or an output seems to contain another company's information, who gets told, and how fast
Put it on one page
The five items fit on a single A4 page. Write each in one or two sentences of "what, who, how", place it where everyone can see it, and add the date written and the next review date. A short document written for your own work is followed better than a copied template.
Do not only prohibit: provide a path
A total ban does not stop use; it moves use to personal accounts, out of sight — shadow AI. Show the safe, company-provided way first, then draw the line beyond it.
Summary: today's checklist
- Named the approved tools
- Wrote down what must never be entered
- Decided that outputs are checked by a person before use
- Set the contact point for problems, and a review date
Review your current posture with 25 questions. Runs in your browser only.
Check your understanding
Tap an answer to check yourself. Nothing is saved or sent.
Q1. What tends to happen when the only rule is a total ban?
See the answer
A ban alone moves use out of sight (shadow AI). Provide an approved path first.
Q2. What do the AI Business Operator Guidelines expect of users?
See the answer
The MIC/METI guidelines expect proper use by users too, including preventing inappropriate input of personal and confidential information.
Q3. What shape should the rule document take?
See the answer
A short document written for your own work, reviewed regularly, is the one that gets followed.
Read next
Stop Reusing Passwords — The First Step
Why reusing the same password is dangerous (credential-stuffing / password-list attacks) and how to stop, step by step, based on official IPA and JPCERT/CC guidance.
Read more →What Is the Cyber Threat Forecast? The Four Levels and How to Read Them
How to read the Cyber Threat Forecast, without technical terms: the four levels (Normal, Attention, Warning, Emergency), why Japan and the world have separate levels, and how to use the page day to day.
Read more →See the latest threat intelligence