What should an internal guideline for the use of AI contain?

A list of approved tools, a clear definition of the data that must not be entered into them (personal data, contracts, source code, know-how), a rule on human checking of outputs and a responsible person people can turn to. Alongside that, instruction of employees and a record of who completed the training and when. We write the guideline on one or two pages so that people actually use it.