What should be in a company AI acceptable use policy that staff will actually follow?

We've told staff they can use AI tools but we haven't given them clear rules and now we're seeing inconsistent and sometimes risky behaviour — client data in ChatGPT, AI-drafted documents going to clients without review. We need a policy that actually changes behaviour without being so restrictive that it pushes AI use underground. What do effective AI acceptable use policies actually contain?