AI Writing Disclosure Policy at Work: What to Require and Why

TL;DR: An AI writing disclosure policy at work should govern accountability, not tools. Require three things: a named person who owns every judgment in a document, verification of facts before anything leaves the company, and disclosure wherever a reader would reasonably change their trust if they knew a model drafted it (external publication, customer commitments, anything legal or regulated). Skip "AI-assisted" labels on routine internal text; they tell readers nothing and expire the day autocomplete becomes standard. The trust problem underneath disclosure is different: AI drafts sound like nobody. Model capability and user-data conditioning are separate layers. The labs improve the first and cannot supply the second, so the fix is to give the model a measured profile of how you actually write, then hold yourself to the same standard you would for a typed draft.

Your team already uses ChatGPT for emails, Claude for memos and Copilot for everything else, and nobody has written down when to say so. A client noticed. Now you need an AI writing disclosure policy by Friday, and the drafts you have found online either ban everything or label everything.

Both fail for the same reason: they regulate the tool when the reader cares about the person. This guide gives you the policy that survives contact with a real team, the wording for each tier, and the part most policies miss: what to do about writing that is accurate, disclosed and still sounds like no one you have ever met.

Why Do Companies Need an AI Writing Disclosure Policy Now?

Because the writing is already happening, the readers have already noticed, and silence is a policy too. Without a written rule, every employee decides alone whether to mention that a model drafted the proposal, and the decisions are inconsistent in exactly the way that gets discovered.

Three things changed. AI drafting moved from a separate tab into the editor itself, so "did you use AI" has stopped being a yes-or-no question. Readers learned the tells: the balanced triplets, the "I hope this finds you well" openers, the paragraph that summarises the one above it. And regulators started writing text of their own. Article 50 of the EU AI Act, applicable from 2 August 2026, requires deployers to disclose AI-generated text published to inform the public on matters of public interest, with an exemption where a person has reviewed the content and holds editorial responsibility for it.

That exemption is the most useful sentence in the whole regulation for a workplace policy. The lawmakers landed on the same principle you should: what matters is whether a named human reviewed and stands behind the text, not which software produced the first draft.

The cost of having no policy shows up as an invented figure in a proposal that nobody checked, a term sheet pasted into a consumer chatbot, and a performance review that reads like a template. None of these is a disclosure failure in the narrow sense, and all of them are what a disclosure policy is really for.

What an AI Writing Disclosure Policy Should Actually Cover

An AI writing disclosure policy that works has four parts, and disclosure is only one of them. Written in order of importance:

1. Accountability. The person whose name is on the document owns every claim, number, commitment and judgment in it. "The AI wrote that part" is not a defence, in the same way "my assistant drafted it" never was.
2. Verification. Facts, figures, quotes, names and dates are checked against a source before the document leaves the company. Models produce plausible specifics with the same confidence as true ones.
3. Disclosure tiers. A short list of document types that carry a disclosure line, with the exact wording. Everything not on the list needs no label.
4. Confidentiality. What may never be pasted into an external model: customer data, unreleased financials, personal information, anything under NDA. Which tools are approved for which data class, and where to check the current list. We covered what each vendor keeps in what happens to your writing samples, and the same rules apply to a term sheet.

Notice what is missing: a list of permitted tools, a percentage of AI content that triggers a label, and a detection step. Tool lists age in months and percentages are unmeasurable once drafting lives in the editor. Detection, as we showed in the AI detection 2026 guide, flags real human writing and misses edited AI text, so building policy on it punishes the wrong people.

Keep the whole thing to one page. A policy nobody reads protects nobody.

The Three Disclosure Tiers That Hold Up in Practice

Disclosure should track reader impact: the more a reader would change their behaviour on learning a model drafted the text, the more explicit the disclosure. Three tiers cover almost every workplace document.

The lines between tiers need judgment calls, and the policy should say who makes them (usually the sender's manager, defaulting to the higher tier when unsure). Pushing everything into the top tier to be safe is how you arrive at the universal label, the first of the two common policies that fail.

Before you publish the tiers, run one check on your own writing: paste a recent AI-drafted email into the Humanity Score test and see how far it sits from text you typed yourself. That distance is the gap your policy has to close, and it is usually larger than the sender thinks.

Why "AI-Assisted" Labels on Everything Fail

A label on every document carries no information, because it does not distinguish a spell-checked sentence from a memo the sender never read. The reader learns that a tool was involved somewhere, which they already assumed, and learns nothing about the question they actually have: did a person think about this?

Universal labels also decay. Drafting assistance is now built into Outlook, Google Docs, Word and Slack, so the label will soon be true of essentially all business text, at which point it informs nobody and is quietly dropped.

The third failure is subtler. Once the label exists, "I disclosed" replaces "I checked", and the label becomes a permission slip for sending unread text, the exact outcome the policy was supposed to prevent.

Why Banning AI Writing Fails Faster

A ban does not stop the use; it stops the reporting of the use. Employees keep drafting with a model on their phone, paste the result into the approved editor, and the company loses the one thing a policy could have given it: visibility into where the drafting happens and what data goes into it.

Bans also punish the wrong behaviour. The employee who uses Claude to turn twelve bullet points into a memo, then rewrites every paragraph and checks each figure, has done exactly what you want. The employee who types a lazy draft and sends it unread has not. A ban treats the first as a violation and the second as compliant.

The one legitimate ban is narrow: specific data classes into specific tools. "No customer personal data into consumer chat apps" is enforceable and stays true as models improve. "No AI for writing" is neither.

The Trust Problem Disclosure Cannot Fix

Here is the part most policies skip. A document can be accurate, verified, disclosed at the right tier, and still cost you trust, because it sounds like nobody in particular.

Readers use voice as evidence. A message that arrives in the sentence rhythm they know from a colleague is proof that this specific person considered the matter. The same message in the smooth, hedge-free register every model defaults to produces the quiet conclusion "they did not really write this", and no footer changes it. Disclosure answers "was a tool involved". It cannot answer "did you mean it".

The usual company fix is a style guide entry: "Our tone is professional yet friendly." That makes the problem worse, not better. "Professional yet friendly" describes thousands of people. AI does not know your tone; it knows words that describe tone, and every employee who types those words gets the same generic register back. We took that apart in adjectives are not your voice, and it applies to a team style guide exactly as it applies to a personal one.

The instinct that a stronger model will solve this is also wrong, and it is wrong for a structural reason. Model capability and user-data conditioning are separate layers. Labs improve the first with every release and cannot supply the second, because nothing your team has ever written was in the training data and no update adds it. A better model follows vague instructions more faithfully, which means a more polished version of the same nobody. We showed the mechanism in why better models still don't know your voice.

What a voice actually consists of is measurable. It lives in sentence length, qualifier placement, transitions and punctuation: how long your typical sentence runs, whether you hedge before a recommendation or after it, whether you open with the ask or build to it, how many commas you tolerate. Those are counts, not adjectives, and a count can be written as an instruction a model will follow.

How Do You Keep Trust When AI Drafts in Your Name?

Give the model a measured profile of how you write, then apply the same accountability rule you would to a typed draft. The disclosure question then takes care of itself, because the text that arrives is recognisably yours and you have checked every claim in it.

The profile is the step most teams miss. A Writing Twin for ChatGPT, Claude, Gemini or Copilot is a Style Profile built from a sample of your real writing: it states your sentence-length range, hedging habits, transitions and punctuation as explicit instructions instead of a tone label. Pasted into custom instructions, a Claude Project or a Copilot prompt, it conditions every draft on you rather than on the average of everyone who typed "professional yet friendly". A team uses a shared brand profile for external content and individual profiles for anything sent under a person's name, the setup we walk through in AI writing for teams.

The upside compounds. Because capability and conditioning are separate layers, each stronger model executes a measured profile more faithfully than the last, so the profile you build this quarter gets better results next year untouched. The tone label in the style guide stays exactly as vague as the day it was written.

Two practical rules close the loop:

• Read it as if you typed it. Every sentence you send under your name is a sentence you are prepared to defend in a meeting. If you would not have written a claim, cut it or check it.
• Run the side-by-side once a quarter. Take a message you actually sent, have the model draft the same message from your brief, and count: words per sentence, hedges and where they sit, commas, opening line. If the numbers drift apart, the profile needs a refresh.

A Policy Template You Can Adapt This Week

Below is a one-page policy that implements everything above. Replace the bracketed items and delete anything that does not apply.

1. Purpose. This policy sets out how [Company] uses AI writing tools and what we owe our readers when we do.

2. Accountability. The person whose name appears on a document is responsible for every claim, figure, commitment and judgment in it, regardless of which tools produced any draft.

3. Verification. Before any document leaves [Company], the sender confirms that facts, figures, quotes, names and dates have been checked against a source. Model-generated numbers and quotes are unverified until checked.

4. Disclosure.

• Tier 1 (no disclosure): internal email, notes, status updates, drafts, summaries of shared documents.
• Tier 2 (standing disclosure): published content and external reports carry the note "Drafted with AI assistance, reviewed and approved by [name]."
• Tier 3 (explicit disclosure): customer commitments, contracts, regulatory or HR documents state in the document that AI drafting tools were used and name the reviewer.
• When unsure of the tier, choose the higher one and ask [manager role].

5. Confidentiality. The following may not be entered into any AI tool not on the approved list at [location]: customer personal data, unreleased financial information, material under NDA, employee records. The approved list states which data classes each tool may receive.

6. Voice. Text sent under an individual's name should read as that individual's writing. [Company] provides Style Profiles for approved tools; senders are expected to use their own profile for personal correspondence and the brand profile for published content.

7. Review. This policy is reviewed every [six months] by [owner], or sooner if the approved tool list or applicable regulation changes.

Six of the seven sections will survive every model release. Section 5's approved list is the only part that needs regular updating, which is why it lives at a link rather than in the policy text.

How to Roll the Policy Out Without a Revolt

Announce it as permission, not restriction, because for most of your team it is. They are already drafting with AI and half-worried about it, and a policy that says "yes, here is how, here is the line" lands as relief.

Three steps make the difference between a policy that is read and one that is filed:

1. Show the tiers with real examples from your own company. Take last month's newsletter, a customer proposal and an internal update, and sort them in front of the team. Abstract categories become obvious the moment someone sees their own document placed.
2. Give people the voice tool on day one. A policy that says "sound like yourself" without a way to do it is a demand. Set up profiles for sales, support and leadership first.
3. Make verification cheap. Put a two-line checklist ("Where did this number come from? Who said this quote?") in the template for any Tier 2 or Tier 3 document. Most verification failures are the absence of a prompt to check, not laziness.

Then measure something. The number of times a customer asks "who wrote this" is the metric that matters, and when it falls after the rollout, the drop will come less from the disclosure line than from writing that sounds, once again, like the person who sent it.

Nothing about your team is in the model, and no model release will put it there. A disclosure policy handles the accountability half of that problem. The voice half is yours to solve, and it starts with measuring how you actually write instead of describing it. Run the Humanity Score test on a recent draft to see where your team's writing stands today, then build the Style Profiles your policy's Section 6 promises.