A staff-facing Word document (.docx) with 8–10 golden rules for AI use, an 8-row data-handling guide (covering general business data, anonymised data, personal data, financial details, health information, confidential contracts, and internal strategy), role-aware guidance for individual contributors / managers / technical roles, an incident-reporting process, and a printable wallet card. Includes two free Excel companions (.xlsx) — a Training Matrix mapping AI topics to roles with completion tracking, and an AI Tools Glossary pre-pinned to the tools your staff actually use.
US-specific obligations covered
The output is anchored on the regulations that apply to AI deployments in US. The top frameworks cited:
Colorado AI Act — SB 24-205 (2024), repealed and reenacted by SB 26-189 'Automated Decision-Making Technology' (2026)state_legislation · Enacted - not yet in force
Developers of covered ADMT must give deployers technical documentation (intended uses, categories of training data, known limitations, usage instructions); deployers must notify individuals before ADMT use in a consequential decision and disclose an adverse outcome within 30 days; consumers may request data correction and meaningful human review. Core obligations begin 1 January 2027.
Texas Responsible AI Governance Act (HB 149)state_legislation · In force
AI developers and deployers must avoid prohibited uses, provide clear disclosures when consumers interact with AI in consequential contexts, conduct algorithmic-discrimination assessments for in-scope systems, and report adverse incidents to the Texas Attorney General. Compliance with NIST AI RMF and recognised standards is treated as a rebuttable presumption of reasonable care.
California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)state_legislation · In force
Businesses must disclose automated decision-making logic upon consumer request, allow opt-out of profiling for targeted advertising or significant decisions, and conduct and document risk assessments for high-risk data processing activities.
California Bot Disclosure Law (SB 1001 — Cal. Bus. & Prof. Code §§17940-17943)state_legislation · In force
Operators of bots that interact with California consumers in commercial or electoral contexts must clearly and conspicuously disclose that the consumer is communicating with a bot, with the disclosure designed to inform a reasonable person communicating with the bot. Disclosure must not be hidden behind interaction or buried in a privacy notice.
How the Employee AI Guidelines approaches this
You describe your organisation and the staff roles in scope. The tool produces a plain-English guidelines document written for frontline employees — not for lawyers — covering what AI tools they can use, what they must not do, and how to escalate concerns.
The output is editable so it can be aligned with your induction and mandatory-training materials. It is a drafting aid intended for review by HR, clinical education, or information-governance leads before it reaches staff.
What you get
✓ Readable by frontline staff — short sentences, concrete examples, no legal jargon.
✓ Role-aware: individual contributors, managers, and technical roles each get guidance written for their context.
✓ Includes a printable wallet card summarising the most critical rules for day-to-day reference.
✓ Supports a no-blame reporting culture — the escalation process encourages concerns to surface early.
Frequently asked
What should a US employee AI-use guideline cover that a general IT acceptable-use policy doesn’t?
It needs AI-specific rules a generic IT policy doesn’t address: which AI tools staff may use for which data classes (the biggest recurring gap is employees pasting confidential or personal data into a consumer AI tool with no enterprise data agreement), a disclosure rule for when AI-assisted work product must be labelled as such, and a no-blame escalation path for when an employee realises they used AI somewhere they shouldn’t have. It is deliberately not the same document as an HR AI-in-employment-decisions policy — EEOC guidance on AI in hiring, promotion, and termination decisions is a separate compliance surface with its own accountable owner. Employee AI Guidelines is written for the "how staff use AI tools day to day" question, not the "how AI is used to make decisions about staff" question.
Does the NIST AI Risk Management Framework apply to employee AI-use guidelines?
It’s relevant as the de facto US reference framework, but it’s voluntary — NIST AI RMF 1.0 (January 2023) and the Generative AI Profile (NIST AI 600-1, July 2024) are not binding law, though they are referenced in federal procurement criteria and in state statutes including Colorado’s AI Act as evidence of reasonable care. An employee-facing guideline should reflect RMF’s Govern/Map/Measure/Manage structure in plain language rather than cite it as a compliance requirement staff must satisfy directly. Employee AI Guidelines translates the Manage function into the wallet-card-level "what to do if something goes wrong" rule employees actually need.
Is the Colorado AI Act relevant to a company’s employee AI usage guidelines today?
Not directly, and not yet at all in most cases. Colorado’s original AI Act (SB 24-205) never came into force; it was repealed and reenacted as SB 26-189 (signed 14 May 2026), effective 1 January 2027, and it governs "consequential decisions" — a defined list including employment — not general internal tool-use guidance. It becomes relevant to a company’s AI governance once AI is used to make an employment decision (hiring, promotion, discipline), at which point the deployer duties (impact assessment, consumer/worker notice, adverse-action explanation) apply from 2027 — that’s a distinct policy surface from staff-facing usage guidelines. Employee AI Guidelines flags this distinction rather than importing Colorado’s consequential-decision duties into a document about day-to-day tool use.
Ready to generate?
$49 · one-time — answer a 6-question intake (including jurisdiction = US), and download your tailored document immediately.