People paste things into AI tools because it saves them hours. That is good. The risk is that without guidance, someone eventually pastes the wrong thing: a client's personal information, a payroll export, a password. Once it is inside a consumer AI tool you cannot pull it back, and under POPIA the responsibility for that information sits with your business, not with the staff member who pasted it.
The answer is not a ban. Bans push AI use out of sight, where you can neither see it nor guide it. The answer is a short, plain policy that names what is allowed, draws one hard line, and makes it safe to ask questions. What POPIA says about pasting information into AI tools is its own article; this one gives you the policy.
That last clause matters most. Every rule in the policy fails eventually; what protects the business is hearing about it immediately.
Copy it, replace the placeholders, and delete anything that does not apply. It fits on one page on purpose.
[Company name] AI use policy, last reviewed [date]
Do not send it as an email attachment. Hold a fifteen-minute meeting, walk through the rules with two or three examples from your own work, and answer questions. Name the owner out loud. Put a review date in the calendar one quarter out, because the tools and their settings change faster than any policy.
This is a usage policy for your own staff. It does not cover the contracts behind the tools: data processing terms with AI vendors, POPIA operator agreements, client-facing disclosure, or choosing the right tool tiers in the first place. That is the guardrails half of our AI Adoption program, which sets up the policy, the tool contracts and the first working pilot together.
This article is practical guidance from implementation work, not legal advice. For a formal opinion on your POPIA position, speak to a privacy attorney.
No. POPIA never mentions AI. But it governs personal information wherever it is processed, including inside AI tools, and it requires you to take reasonable security safeguards. A short AI use policy is the practical way to make those safeguards real once your team starts using AI tools.
Not for an internal usage policy like this one. It sets house rules for your own staff, like an email or expenses policy. Involve a privacy attorney when AI touches contracts: client terms, data processing agreements with vendors, or regulated industries.
Start with one general assistant on a business tier, because business tiers of the major tools commit not to train on your data by default. Approve the few tools people already reach for, name them, and add more only when someone makes the case for a job the approved tools cannot do. What that costs in rands is covered in its own article.
The AI Adoption program pairs this policy with the right tool contracts, a working first pilot, and spend you can see. Sized for 10 to 1,000 people, priced in rands.
Book a call if you want one, or just send the form. We reply within one business day. POPIA-compliant.