Generative AI tools have become part of everyday administrative work. Assistants use them to draft emails, summarize documents, transcribe meetings, research topics, clean data and write first drafts of reports. Used well, AI makes a good assistant faster. Used carelessly, it can leak confidential data, introduce errors into client deliverables, violate contracts or regulations, and damage trust.
Most companies now need a clear AI usage policy, and that policy should explicitly cover remote assistants and contractors. This guide explains what a practical policy should include: approved tools, data classification rules, prohibited uses, human review, disclosure, recordkeeping, training and enforcement. It also covers how to roll it out to remote staff. For background on AI and assistants working together, see using AI tools and a virtual assistant together.
Why remote assistants need explicit rules
Remote assistants often work across many of your systems and handle sensitive data: executive email, financial records, customer information and HR files. They may also be enthusiastic users of AI tools, sometimes on personal accounts. Without clear rules, an assistant might paste a confidential contract into a free AI tool to summarize it, unaware that the data may be retained or used to train models under that tool's terms. Clear rules protect the company and the assistant.
Principles
A good policy rests on a few principles:
- Use AI to assist, not to decide. Humans remain responsible for outputs and decisions.
- Protect data. Only approved tools for approved data.
- Verify before use. AI outputs can be wrong, incomplete or invented.
- Be transparent where disclosure is required or expected.
- Follow the law and contracts, including privacy, confidentiality and industry rules.
The NIST AI Risk Management Framework offers a useful structure for thinking about AI risks across an organization (NIST AI RMF).
Approved tools
List the AI tools assistants may use, with the account type and purpose. For example: the enterprise version of an AI assistant built into your productivity suite, an approved transcription tool for internal meetings, and an approved writing assistant. Specify that:
- Only company-provided accounts may be used for company work.
- Personal or free accounts must not be used with company data.
- New tools require approval from IT or security before use.
- Browser extensions and plugins with AI features need approval, because they may read page content.
Review enterprise terms for data retention, training on customer data, storage location and security before approving tools.
Data classification rules
Tie AI use to your data classification. A simple scheme:
| Data class | Examples | AI use |
|---|---|---|
| Public | Published website content, press releases | Allowed in approved tools |
| Internal | Internal procedures, non-sensitive notes | Allowed in approved enterprise tools |
| Confidential | Contracts, financials, client data, employee data | Only in approved tools explicitly cleared for confidential data |
| Restricted | Health information, payment card data, credentials, legal privileged material | Not allowed unless specifically approved with safeguards |
Assistants should never enter passwords, MFA codes, full payment card numbers or bank details into AI tools.
Prohibited uses
Common prohibitions include:
- Making decisions about people, such as hiring, firing, performance ratings or credit, based on AI output.
- Generating legal, medical, tax or financial advice for clients.
- Impersonating a person, including voice cloning, without authorization.
- Creating fake reviews, endorsements or misleading content.
- Using AI to bypass security controls.
- Recording meetings with AI tools without required notice and consent.
Good prompting habits that protect data
Many risks can be reduced through simple habits:
- Minimize: include only the information the task needs. To improve the tone of an email, the tool doesn't need the client's account details.
- Anonymize: replace names, companies and identifiers with placeholders where possible, then restore them in the final version.
- Use summaries instead of full documents when the full text isn't necessary.
- Avoid pasting entire inboxes, spreadsheets or databases into tools not approved for that data.
- Check settings: confirm chat history and data-sharing settings match company requirements.
These habits become second nature quickly and make AI use safer without slowing work down.
Human review
Every AI output used in work must be reviewed by the assistant, and important outputs by the responsible person. Reviews should check facts, numbers, names, dates, tone and citations. AI tools sometimes invent sources or details, so links and references must be verified. For client-facing or external content, the leader approves before sending, as with any other draft.
Meeting recordings and transcription
AI note-takers are popular and risky. Rules should cover:
- Which meetings may be recorded or transcribed, and which never, such as legal, HR, board or sensitive client discussions.
- Notice and consent requirements, which vary by jurisdiction.
- Where transcripts are stored, who can access them and how long they're kept.
- Review of AI summaries before distribution.
See delegating meeting notes and action items.
Disclosure
Decide when AI use should be disclosed. Some clients or contracts require disclosure of AI use in deliverables. Some industries have rules or guidance on AI use, such as in legal or healthcare settings. Communications that appear to come from a person should not misrepresent automated content when that would mislead.
Recordkeeping
For significant uses, such as client deliverables or analysis that informs decisions, keep a light record: the tool used, what it was used for and who reviewed the output. This helps with quality control, client questions and audits.
Training
Train assistants on the policy at onboarding and at least annually:
- Approved tools and how to access them.
- Data classes, with examples from their actual work.
- Prompting practices that avoid unnecessary data, such as anonymizing names when possible.
- How to verify outputs.
- What to do if they make a mistake, such as entering confidential data into an unapproved tool.
Make it easy to ask questions, and treat honest mistakes reported promptly as learning opportunities.
Incidents
If confidential data is entered into an unapproved tool, treat it as a potential security incident. The assistant reports it immediately; the security contact assesses the exposure, contacts the vendor if needed and decides whether notifications are required. See incident response for remote assistants.
Rolling out the policy to remote staff
- Share the policy in writing and walk through it on a call.
- Ask assistants to confirm they've read it.
- Provide approved tools before asking assistants to stop using others.
- Include AI use in regular check-ins: what's working, what's risky.
- Update the policy as tools and rules change.
Policy template outline
- Purpose and scope (including contractors and remote assistants).
- Principles.
- Approved tools and accounts.
- Data classification and AI use rules.
- Prohibited uses.
- Human review requirements.
- Meetings and transcription.
- Disclosure.
- Recordkeeping.
- Training.
- Incidents and reporting.
- Enforcement and review schedule.
A worked example
A wealth management firm wants its remote client service assistants to use AI for drafting routine emails and summarizing internal meeting notes, but worries about client data. The firm approves the enterprise AI assistant within its productivity suite, which its IT team has configured not to use firm data for training, and prohibits all other AI tools for client data. The policy bans entering account numbers or Social Security numbers into any AI tool, and requires advisors to approve any client-facing message drafted with AI. Assistants are trained with real examples. Three months in, drafting time has dropped and there have been no data incidents.
Common mistakes
No policy. Assistants guess.
Banning everything. People use personal tools anyway.
Ignoring browser extensions. They can read sensitive pages.
No review rule. AI errors reach clients.
Frequently asked questions
Should remote assistants use AI tools at all?
Yes, with approved tools and clear rules. AI can make good assistants more effective.
Can assistants use free AI tools for company work?
Generally no, unless the tool has been reviewed and approved for the data involved.
Who is responsible for AI errors?
The people who use and approve the output. AI doesn't change accountability.
Does ExecWing follow client AI policies?
Yes. Assistants follow each client's policies, tools and data rules.
Want a dedicated assistant who already knows this playbook?
ExecWing places dedicated, managed assistants from the Philippines, Mexico and Colombia with US leaders, on a schedule customized to your needs and budget. Month-to-month, quoted per role. See pricing or how it works.
Book a 20-minute fit call