Somewhere in your organization right now, someone is pasting a customer email, a code snippet, or a draft contract into a public AI chatbot. They're not being malicious. They're being productive, and nobody told them not to — or if someone did, the rule was a forty-page PDF they never opened.
This is often called shadow AI, and a blanket ban rarely fixes it. People who find AI useful route around bans, and you lose all visibility. The better approach is a short, clear policy that tells people what's safe to do, makes the approved path easier than the unapproved one, and explains the reasons behind the rules.
Principles before paragraphs
A policy people follow shares a few traits:
- Short. Two to four pages beats twenty. Anything longer won't be read.
- Plain language. Write for an employee on a busy Tuesday, not for a lawyer.
- Specific. "Use good judgment" is not guidance. "Don't paste customer personal data into tools outside the approved list" is.
- Enabling, not just restricting. Tell people what they can do, and give them approved tools to do it with.
- Owned and reviewed. Name an owner, and revisit the policy regularly. This field moves fast.
What to include
1. Purpose and scope. Who the policy covers (employees, contractors) and what it covers (generative AI tools, AI features built into other software, and AI-assisted coding).
2. Approved tools and how to request new ones. List what's sanctioned. Provide a lightweight, fast route to ask for something new — a slow process pushes people back to workarounds.
3. Data rules. This is the heart of the policy. Define what categories of data can and can't be entered, ideally using a simple tiering like the one above that maps to your existing data classification scheme. Be explicit about personal data, customer information, credentials, source code, and regulated data.
4. Human accountability. The person using AI output owns it. Require review of anything consequential before it's sent, shipped, or relied on, because models can produce confident, plausible, and wrong output.
5. Transparency. Decide when AI assistance needs to be disclosed — to customers, in regulated deliverables, or in public content.
6. Intellectual property. Address ownership of generated content, the risk of output resembling third-party material, and rules for using external code or text in your products.
7. Vendor requirements. For any tool that handles company data, check data retention, whether your inputs are used to train models, security certifications, and where data is processed. Enterprise agreements often differ significantly from free consumer tiers on exactly these points. Remember that AI components and gateways are part of your supply chain too; the LiteLLM breach is a useful case study in how a widely used AI dependency became a route to stolen credentials.
8. High-risk uses. Flag uses that need extra review or are prohibited — for instance, automated decisions about hiring, credit, or other significant outcomes affecting individuals.
9. Security and incidents. Tell people how to report a mistake, such as pasting something they shouldn't have, and make that reporting safe and blame-free. Early reports let you act; hidden mistakes don't.
10. Training and review. Commit to training staff and to reviewing the policy on a fixed schedule.
A starter template
AI USAGE POLICY — [Company], v1.0, reviewed [date], owner: [role]
1. WHO THIS APPLIES TO
All employees and contractors using AI tools for company work.
2. APPROVED TOOLS
Use only tools on the approved list at [link]. To request a new tool,
submit a request at [link]; we aim to respond within [X] working days.
3. DATA RULES
GREEN Public information and non-sensitive drafts: any approved tool.
AMBER Internal business information: approved enterprise tools only.
RED Credentials, personal data, client-confidential or regulated
data: never enter into an AI tool unless explicitly approved
for that purpose by [Security/Legal].
4. YOU ARE ACCOUNTABLE
You are responsible for any output you use. Review it for accuracy,
bias, and fit before relying on or sharing it.
5. DISCLOSURE
Disclose AI assistance where [client contract / regulation / policy]
requires it, and never present AI output as verified fact without
checking it.
6. HIGH-RISK USES
Decisions that significantly affect individuals (e.g. hiring, credit,
performance) require [Legal/HR] review and must not be fully automated.
7. IF SOMETHING GOES WRONG
Report it to [channel] immediately. Good-faith reports are never
punished.
8. QUESTIONS AND REVIEW
Contact [owner]. This policy is reviewed every [6] months.Treat this as a starting point to adapt to your risk profile and legal environment, and have counsel review it before adoption.
Pair the policy with frameworks
You don't need to invent governance from scratch. The NIST AI Risk Management Framework offers a widely used structure for identifying and managing AI risk, ISO/IEC 42001 defines a management system standard for AI, and regulations such as the EU AI Act take a risk-based approach with obligations that phase in over time. Check which apply to your sector and regions, and map your policy to them as it matures.
Mistakes to avoid
- Writing the policy and never telling anyone. A policy no one has read doesn't exist.
- Banning without providing an alternative. Offer an approved tool that actually meets the need.
- Ignoring AI built into existing software. Much AI use arrives as a feature inside tools you already license.
- Treating it as a one-off. Models, tools, and regulations change; schedule reviews.
- Skipping the "why." People follow rules they understand. Explain the risks with real examples.
From policy to practice
A policy sets the rules; training makes people able to follow them. Our AI Risk, Ethics, and Compliance course helps teams translate frameworks into working controls, and Responsible AI and Governance for Leaders gives executives the context to own the decisions. For the practical, role-by-role side, see Generative AI at Work. And if you're planning wider adoption, our post on a practical roadmap for AI adoption shows where governance fits in the sequence.