A newsroom, a university and a government set rules for AI

Start here

If a workplace hands someone an AI tool without a written policy, the practical questions are the same everywhere: what may go into it, what needs a human check, and who answers for a mistake. Three organisations that publish their answers show the shape a policy actually takes once an institution writes it down, rather than leaves it to habit.

What the documents say

NPR's ethics handbook section on generative AI, dated 12 October 2023, tells reporters they remain responsible for accuracy and plagiarism ‘with or without the use of GAI,’ that a significant use should be disclosed to the audience, and that no NPR intellectual property — notes, drafts, coverage memos — may go into a generative AI system NPR has not approved. Harvard's initial guidelines for generative AI tools, a living page retrieved 16 September 2026, sort information into levels and state that Level 2 data and above — research data, HR and financial records, student and medical records — cannot be entered into a publicly available AI tool; only university-approved, contractually protected tools may process it. The UK's Generative AI Framework for HMG, published 18 January 2024, sets ten principles for civil servants and names categories the framework advises against altogether, including fully automated decisions on significant matters and low-latency or high-explainability uses. All three separate what a tool may draft from what a person must still own.

Check this

Read a workplace's own policy against three questions these documents raise: does it name a data-sensitivity tier and say which tier may not leave the building in a prompt; does it say who discloses AI use and to whom; and does it name at least one use it will not permit, rather than only uses it encourages. A policy that only lists benefits and skips a prohibited-use list has not yet done the harder work.

What holds and what fails

These are three institutions' own statements of intent, not audits of compliance; none of the three documents measures how often staff actually follow the rule. The distinction that holds across all three is between a tool cleared for a data tier and the same tool used on default settings, which is where a policy is most often broken quietly rather than deliberately. This is an editorial reading: a policy that never names a forbidden use is easier to write but harder to enforce, because staff have no boundary to check their own judgement against.

• Find your own organisation's written AI policy, if one exists, and check whether it names a data tier.
• Compare who your policy says must disclose AI use against NPR's ‘significant role’ standard.
• Ask whether any tool you use has been through the same kind of security clearance Harvard describes.

None of these three policies is a universal standard; each is one institution's published answer, retrieved as it stood in September 2026 for two of the three and dated for the third. Reading them side by side is a way to see what a policy is actually for: not permission, but a boundary a person can point to.