One Page, Four Questions: Five Books for Turning a Corporate AI Policy Into Team Rules

The AI policy exists. It arrived as a PDF, it runs to thirty pages, it defines large language models, it references the board's risk appetite, and it instructs staff to use AI 'responsibly'. It answers to a regulator, an insurer or an audit committee. What it does not answer is the question a team leader faces at 4.40pm on a Thursday with a client deadline: may I put this material into the tool, and who signs it off?

That gap — between an organisational policy and a team-level decision — is where managers actually work. Closing it does not require an AI strategy. It requires a one-page rulebook with four clauses, written in language a team can enforce, and reviewed when the tools change. The five titles below, read in sequence, supply those clauses.

Begin with where the machine's authority stops

Prediction Machines by Ajay Agrawal, Joshua Gans and Avi Goldfarb treats artificial intelligence as a falling cost of prediction, and asks the operating question: which decisions in this workflow get cheaper, and which become more valuable?

Its practical gift to a manager is a unit of analysis. Take the five deliverables your team produces most often and, for each, name the judgement inside it. If that judgement stays with a person, then any AI output is an input to a decision, not the decision itself. One sentence in a rulebook — 'the model drafts; the named reviewer decides' — settles most of the arguments that otherwise recur weekly.

The book's economic point is equally useful for the data clause. As prediction becomes cheap, judgement and proprietary data become the scarce, valuable elements. Which is precisely why the question of what is fed into a third-party tool deserves a firmer line than the question of which tool is approved.

Then write down the working habits

Co-Intelligence by Ethan Mollick is the most operational of the current workplace titles, and the one most likely to be read by people who do not consider themselves technologists. Two of its ideas translate directly into team rules.

The first is the unevenness of capability: a model can be surprisingly strong on one task and confidently wrong on the neighbouring one, so individual experiments tell you little about reliability in general. The second is the discipline of treating output as a first draft from a fast, fluent and occasionally mistaken junior colleague — checked before it travels, not after.

A workable exercise: circulate the book a fortnight before a team session and ask each person to bring one instance where an AI output required correction. Those corrections, collected, become the check column of the rulebook. Rules drafted from the team's own near-misses are observed; rules drafted from a template are ignored.

Decide what must be checked, and by whom

Weapons of Math Destruction by Cathy O'Neil was published before the current generation of assistants and remains the clearest short account of how automated scoring fails: opacity, scale, and a feedback loop that never gets corrected because nobody is measuring the harm.

For UK managers the employment angle is the live one. Under the Equality Act 2010, an automated screen that disadvantages a protected group is a risk regardless of who supplied the model; the supplier's process becomes your process the moment it shapes your shortlist. The rulebook clause that follows is narrow and enforceable: any AI-assisted decision about a person carries a named human reviewer, a written reason, and a retained record. That also sits comfortably alongside the record-keeping expectations of the Information Commissioner's Office.

Decide what never goes in

Data and Goliath by Bruce Schneier is a book about surveillance, and reads unexpectedly well as a book about liability. Its contribution is to treat data as something that can be lost, combined and later used against the organisation, rather than as an asset to be gathered.

In practice, most teams need a four-line prohibition rather than a taxonomy: no client-identifiable material, no personal data relating to staff or customers, no unpublished commercial figures, and nothing covered by a live confidentiality agreement. Add one exception route — the approved enterprise instance, with the settings the IT function has actually verified — and one instruction that public availability is not the same as permission to use. Legal, regulatory and professional-body obligations across the UK, from UK GDPR to sector rules, make this clause the least negotiable of the four.

Make the page survive contact with a busy week

The Checklist Manifesto by Atul Gawande is the book that answers the headline problem: why well-intentioned written rules go unread.

Its distinction is the one managers most often miss. Policies tend to address ignorance — the belief that people do not know the rule — while the failures that actually occur are failures of execution under time pressure, by people who knew perfectly well. Checklists work when they are short, when they are attached to a defined pause point in the workflow, and when the people using them helped write them. That gives the rulebook its format: four questions, asked at a stated moment — before the draft leaves the building, before the client call, before the paper goes to the board.

The document itself

A team-level AI rulebook drafted along these lines fits on one page: four questions covering permitted use, mandatory checks, prohibited data and declaration; one exception route; one declaration sentence in plain English, of the kind that can be pasted into an email footer or a report cover — for example, that AI tools assisted with drafting particular sections, and that all figures and citations were verified against source.

Give it a version number, a named owner and a quarterly review date, because the tools will change faster than the corporate policy will. Keep it wherever the team already looks for process — the shared drive nobody enjoys, the project template, the onboarding pack.

The thirty-page policy will continue to say everything. The manager's contribution is narrower and more useful: four sentences the team can act on, and the attention to notice when they stop matching the tools in use.