If your team has a web browser, it's likely someone is already trying AI tools at work, whether or not there's a policy. That isn't a reason to panic. It's a reason to give people clear lines.
A small society doesn't need a 40-page framework to begin with. A single page that people actually read is more useful than a long document nobody opens. Here is what I'd want on it.
This is a starting point, not legal or compliance advice. Any policy should go through your own compliance and legal review, and fit with the policies you already have on data protection, information security and conduct.
1. Why we use AI
One or two lines on what AI is for at your society, and what it isn't for. For example: helping staff draft, summarise and find information faster, but never replacing the judgement of the people responsible for members and lending decisions.
This sets the tone for everything else on the page.
2. Approved tools
A short list of the AI tools staff may use for work, and what each one is approved for. Anything not on the list needs sign-off before it's used.
Keep the list short and current. If it's hard to get a useful tool approved, people will quietly use unapproved ones instead.
3. What never goes in
Be specific. No member personal data and no confidential information in any tool that hasn't been approved for it. That includes names, account details, case notes and internal documents.
If staff aren't sure whether something counts, the answer should be to ask first.
4. People decide
AI output is a draft, a summary or a lookup. It is never a decision. Anything that affects a member, a broker or a lending outcome is decided by a person.
We wrote more about this line in Answering versus deciding.
5. You own what you send
Whatever helped write it, the person who sends an email, letter or answer is responsible for checking it. AI can sound confident and still be wrong.
This one line does more to prevent problems than most technical controls.
6. A named owner
One person looks after the policy and the approved tools list. Staff know who to ask, and requests for new tools have somewhere to go.
7. Speak up
A simple way to report a mistake, a near miss or a concern, without blame. You want to hear about problems early, while they're small.
8. A review date
AI tools and how people use them change quickly. Put a review date on the page, such as every six months, and keep to it.
Keeping it to one page
The temptation is to keep adding detail. Resist it. Put the eight points on one page, link to fuller policies where needed, and make it part of how new starters are introduced to the society.
A short policy that everyone understands gives clearer protection than a long one that sits in a folder.
If you're putting something like this together and want to compare notes, I'd be glad to hear how you're approaching it: hello@adastr.co.uk