AI Policy for Employee Handbooks: The Missing Chapter

Employee handbooks are where companies write down the obvious. How to expense a flight. What harassment is and what happens to people who do it. When the office closes. Handbooks are boring by design, and their boringness is an achievement: every page represents some ambiguity that once caused a problem, got argued about, and got settled so nobody has to argue about it again. A handbook is a company's scar tissue, organized alphabetically.

Which is why the missing chapter is so interesting. Right now, at companies everywhere, people work alongside AI every day, and the handbook says nothing about it. Not a page. Employees are improvising answers to questions with real consequences, each person differently, and the company's official position is silence. Silence worked fine when AI meant a search box. It stops working the moment AI becomes something closer to a colleague, one that drafts things under your name, handles pieces of your job, and talks to your teammates.

Want to feel the gap? Here are questions being answered by individual improvisation, today, probably at your company.

An account manager has an agent draft her client emails. They're good; clients respond well. Is she required to tell anyone? Her manager? The client? Does the answer change when it's not an email but a contract summary, or advice?

A analyst delegates his weekly report to an agent and spends the recovered day on deeper work. His output doubled. Is he a star performer or is he misrepresenting his work? Nobody told him, so he decided for himself, and his answer is "star performer," and his colleague who does everything by hand has a different answer, and that quiet disagreement is compounding toward an ugly moment.

A manager notices an agent could absorb about a third of a direct report's role. Is she supposed to raise that? With whom? Is the employee supposed to raise it, knowing what it might imply? The handbook that explains bereavement leave in loving detail has nothing to say about the conversation both of them are avoiding.

Someone pastes a customer's financial data into an agent to get help with an analysis. The security policy, written in 2021, bans "sharing confidential data with unauthorized third parties" and nobody knows whether that sentence applies. It gets debated in a channel. The debate reaches no conclusion. The pasting continues.

None of these people is acting in bad faith. They're doing what employees always do when policy is silent: making it up locally. And locally-made-up policy has a failure signature every HR and legal leader knows by heart. It works until it doesn't, and when it doesn't, the company discovers it has, in effect, dozens of contradictory unwritten policies, one per team, each defensible, none chosen, and the incident that surfaced them is now also a fairness dispute because different people were held to different invisible standards.

So what would the chapter actually say? The companies drafting it, and a few are, keep converging on the same section headings, which suggests the shape is discoverable rather than invented.

A section on disclosure: when working with agents must be visible, to colleagues, to managers, to customers. The emerging norm distinguishes by stakes rather than by blanket rule. Routine internal drafting needs no announcement; anything that leaves the building or carries professional judgment gets a human owner who stands behind it, and in some contexts, a disclosure.

A section on accountability, and this one can be a single sentence with teeth: delegating work to an agent never delegates responsibility for it. If it went out under your name, it's yours, reviewed or not. Every ambiguity downstream gets simpler once this sentence exists.

Delegating work to an agent never delegates responsibility for it. If it went out under your name, it's yours, reviewed or not.

A section on data, rewritten for the actual question people face, which is not "may I share data with third parties" but "which information may flow into which systems, and how would I know." Vague bans produce either paralysis or ignorance. Usable policy names categories and gives examples.

A section on delegation boundaries: what kinds of work may be handed to agents freely, what requires review before shipping, what must never be delegated. Companies discover, writing this, that they're really writing down what they believe judgment is for, which is uncomfortable and overdue.

And a section, the hardest one, on what employees owe the company and the company owes employees when agents change a role. If automation of a task is something an employee should surface rather than hide, the handbook has to make surfacing it safe, or the policy is a trap and everyone will correctly treat it as one. This is where the chapter stops being about AI and becomes about trust, which is what handbooks were always secretly about.

Here's the argument for writing it now rather than after the first incident, and it's not the compliance argument, though that one's coming too, as regulators start asking companies to account for how AI is used in work that touches customers. The better argument is that the chapter is being written either way. Every day of silence, employees add another improvised page: the analyst's page, the account manager's page, the security debate that reached no conclusion. By the time an incident forces the official version, the company won't be writing on a blank slate. It will be overwriting a hundred private policies people have already built habits around, and enforcing rules retroactively against behavior the company's silence permitted. That's the most expensive way to write anything.

Handbooks are scar tissue, but they don't have to be. Once in a while a company gets to write the boring page before the wound. This is one of those times, the window is open, and the only requirement is admitting something everyone already knows: the team changed, and the book that describes how the team works should probably mention it.