Start with a simple policy
A useful AI policy fits on a page. State which tools are approved, what data may be entered, who reviews output that reaches customers and who to tell when something goes wrong. A short rule people follow beats a long one they ignore.
Review it every six months, because tools and risks change quickly.
Classify your data
Sort information into three groups: public, internal and restricted. Restricted data, such as customer identifiers, health or financial records and credentials, should not be pasted into general-purpose AI tools unless a vendor agreement and your own review allow it.
Staff often share data with AI tools out of convenience, so make the safe route the easy one.
Questions for vendors
Ask where data is stored and processed, how long it is retained, whether it is used to train models, who at the vendor can access it and what happens to it if you leave. Get the answers in writing.
Nepal's National AI Policy, approved in 2025, sets up national bodies but standards are still being developed, so do not rely on regulation alone to protect your data.
Review and incidents
Require a person to check AI output before it reaches a customer in any high-stakes setting. Keep a log of errors and near-misses and review it monthly.
Decide in advance how you will correct a wrong answer, notify affected people and fix the cause.
What you get:
- A one-page AI use policy you can adopt this week
- Data classification: what must never go into an AI tool
- Vendor questions on storage, retention and model training
- Human review rules for customer-facing output
- Incident handling when an AI system gets it wrong