The AI Policy Checklist Every Leader Needs Before They Start

A step-by-step assessment for comms and policy leaders — covering tools, budgets, token costs, and data privacy

As you’re reading this, I’m standing in front of a room of Ohio election officials talking about how their offices can use AI. It’s a conversation I have constantly — with campaigns, advocacy organizations, public affairs shops, newsrooms. Everyone wants the policy template. Everyone wants a document they can hand to their board or their boss.

Here’s what I tell them every time: the document is the last step, not the first.

This is the framework I use when organizations bring me in to work through this — a step-by-step assessment that gives you the real picture before you write a single word of policy. The checklist version is attached as a PDF at the end of this piece.

📋 Step 1: Find out what’s already happening

Your employees are already using AI. I promise you this is true regardless of whether you have a policy. The question isn’t whether — it’s how, which tools, and for what.

Send a simple anonymous survey before you do anything else. Ask:

→ Which AI tools are you currently using for work?

→ What are you using them for?

→ Are you using personal accounts or organizational accounts?

→ Have you ever put client, constituent, or confidential information into an AI tool?

That last question is the one that matters most. The answer will tell you exactly how urgent your timeline is.

My read: Most organizations discover two things from this survey. Usage is wider than leadership assumed. And at least one person has already put something sensitive into a free consumer tool without thinking. You need to know that before you write the policy, not after.

🗺️ Step 2: Map where AI can actually help your organization

Before you decide what to restrict, figure out where AI creates the most leverage for your specific work. Run a simple exercise with your leadership team: for each major function in your organization, ask where you’re spending time on tasks that are repetitive, language-based, or research-heavy. Those are your highest-yield starting points.

For a public affairs shop, this might be monitoring regulatory filings, first drafts of comment letters, or translating technical policy language for non-expert audiences. For an election administration office, it might be drafting voter communications, summarizing meetings, or translating materials for non-English-speaking constituencies.

My read: Start with two or three high-value, lower-risk use cases. Get some wins on the board. That builds organizational comfort and a real evidence base, not rules for every hypothetical before anyone has tried anything

The rest of this piece walks through the full build: tool tiers and what they actually cost, how to set token budgets before you get a surprise bill, the privacy and data questions your legal team needs to answer, and the policy template itself. That’s for paid subscribers — along with the printable checklist PDF. If you want access, you can subscribe for $50/year.