[Complete Guide] Steps for Creating and Operating Generative AI Guidelines

Introduction: Starting AI Governance Today

While business adoption of generative AI is advancing rapidly, more companies are facing challenges such as "how far is it okay to use" and "how to manage risks." This guide is a practical manual for practitioners to lead the formulation and operation of generative AI guidelines. It aims not just at restrictions, but at building a foundation for safe utilization.

Preparation Checklist

Please verify the following systems and information before getting started.

• Selection of Project Owner (Responsible Person)
• Liaison points with Legal, Information Systems, and HR Departments
• Organization of current internal IT rules and security regulations
• Survey of AI usage status on the front lines (Shadow IT situation)

Step 1: Define Usage Purpose and Basic Policy

Goal: Clearly define the organization's purpose for AI usage and establish the direction of the guidelines.

Action: Reach consensus with executive management and set specific objectives such as "efficiency improvement," "enhancing creativity," and "improving customer experience." Simultaneously, specify not only "prohibited items" but also "recommended items" to encourage active utilization.

Potential Pitfalls: Emphasizing restrictions too much may stifle frontline usage. Balance is crucial.

Completion Criteria: The basic policy document is approved and ready for company-wide dissemination.

Estimated Duration: 3-5 business days

Step 2: Identify and Classify Risks

Goal: Thoroughly identify risks unique to generative AI and prioritize them.

Action: List risks such as data leaks, hallucinations (misinformation), copyright infringement, and inappropriate content generation. Clarify differences from existing IT risks and specifically review the classification of input data confidentiality.

Potential Pitfalls: Tendency to focus only on technical risks. Include compliance and brand risks as well.

Completion Criteria: Risk map is complete, and mitigation priorities are determined.

Estimated Duration: 2-3 business days

Step 3: Specify Usage Rules

Goal: Create specific rules so the frontline does not hesitate in decision-making.

Action: Document "levels of data allowed for input," "verification obligations for outputs," and "list of available tools." Specifically define confidential information with concrete examples to prevent variations in judgment.

Potential Pitfalls: Abstract expressions lead to different interpretations on the front lines. Include abundant concrete examples.

Completion Criteria: Draft rule proposal is complete and reviews by relevant departments are finished.

Estimated Duration: 5-7 business days

Step 4: Select and Standardize Approval Tools

Goal: Prevent Shadow IT and establish a manageable tool environment.

Action: Define the scope of use for paid tools with enterprise features and free tools. Consider proxy settings or input control via DLP tools as needed to establish technical guardrails.

Potential Pitfalls: Delayed tool selection leads to the front lines starting to use tools independently. Swift decisions are necessary.

Completion Criteria: Recommended tool list is finalized, and access permission settings are completed.

Estimated Duration: 5-10 business days

Step 5: Education Program and Literacy Improvement

Goal: Ensure all employees understand risks and possess the ability to use AI correctly.

Action: In addition to guideline explanation sessions, conduct training on distinguishing hallucinations and basics of prompt engineering. Simulated experiences using case studies are effective.

Potential Pitfalls: One-time training does not stick. Continuous communication is required.

Completion Criteria: Completion rate of training for all employees exceeds 90%, and passing scores are achieved on comprehension tests.

Estimated Duration: Ongoing (Initial phase: 2 weeks)

Step 6: Establish Operation System and Monitoring Mechanism

Goal: Monitor adherence to rules and create a mechanism to detect violations.

Action: Establish a system for collecting usage logs and schedule regular audits. Clarify reporting routes and handling policies in case of violations, creating an environment that encourages reporting while maintaining psychological safety.

Potential Pitfalls: Overly strict monitoring may lead to concealment. Emphasize that the goal is improvement.

Completion Criteria: Monitoring system is operational, and the schedule for the first audit is confirmed.

Estimated Duration: 5-7 business days

Step 7: Regular Review and Improvement

Goal: Update guidelines in line with technological evolution to prevent obsolescence.

Action: Set a review cycle of once every six months and collect feedback from the front lines. Establish a flow for temporary revisions when new risks or tools emerge.

Potential Pitfalls: Treating it as a one-time creation leads to divergence from reality. Treat it as a living document.

Completion Criteria: Revision schedule is established, and the date for the first review is set.

Estimated Duration: Once every six months (Planning takes 2 days)

Tool and Resource Comparison Overview

Tool Type	Advantages	Disadvantages	Recommended Use
Enterprise Paid AI	Data not used for training, rich management features	Costly	Tasks handling confidential information
Free Web Services	Convenient, no cost	High risk of data leakage	Summarization of public information, etc.
On-Premises AI	Complete data management	High implementation and maintenance costs	Extremely confidential tasks

Troubleshooting Q&A

Q1: What if the frontline does not follow the rules?

A: Prioritize re-educating them on why the rules exist rather than imposing penalties. However, for malicious violations or repeated offenses, take action based on regulations.

Q2: Should the use of free tools be completely prohibited?

A: From the perspective of business efficiency, complete prohibition may not be realistic in some cases. Limit usable scenarios (e.g., do not input confidential information) and allow self-responsibility use as an option.

Q3: Who owns the copyright of the output?

A: Current legal interpretation is complex. Clearly state in the guidelines that "AI-generated materials must be edited and verified by humans who bear responsibility," and organize rights relationships.

Q4: Are the same rules applicable for overseas branches?

A: Laws and regulations vary by country (e.g., GDPR). While the basic policy should be common, additional local regulations must be established for each region.

Q5: How to report discovered guideline violations?

A: To prevent concealment, establish a voluntary reporting system. Building a culture that rewards early detection and early response is important.

Advanced Tips & Application

When considering AI utilization as infrastructure, guidelines are devices that control "induced demand" rather than "restrictions." Making rules too strict causes latent demand to surface as Shadow IT. Rather, providing a safe official route and visualizing usage status is an effective strategy to raise overall organizational AI literacy. Furthermore, involving key personnel on the front lines as "AI Champions" alongside the legal department encourages bottom-up rule improvements and increases adoption rates.

Progress Management Template

Please confirm the following items weekly.

• [ ] Step 1 Policy Formulation Complete
• [ ] Step 2 Risk Identification Complete
• [ ] Step 3 Rule Draft Completed
• [ ] Step 4 Tool Selection Complete
• [ ] Step 5 Training Implementation Rate Confirmed
• [ ] Step 6 Monitoring System Operational
• [ ] Step 7 First Review Schedule Set