What policy require to follow around ChatGPT/OpenAI?

In general, the privacy community has advised that Organizations address AI in their policies, and cover at minimum the following 3 topics:

1. Prohibited uses for AI such as ChatGPT, such as using the AI to check for errors in confidential organizations or customer documents, or in-scope code and systems 

2. Uses that may be permitted, but for which approval must first be obtained in writing from X authority, such as generating code or documents before merging said content with proprietary or confidential assets. 

3. Uses that are permitted most of the time, such as creating marketing or administrative materials, generating ideas that don't include organizational secrets