AI governance, the internal policy every company needs
What an AI usage policy has to define, how to write it on a single page, and why it should exist before informal use becomes the norm.
The most common situation today isn't the absence of AI in the company: it's its presence without rules. Teams already use tools, paste information into chats nobody approved, and make decisions based on outputs nobody verified.
A usage policy doesn't stop that. It organizes it.
What the policy has to answer
You don't need a long document. One well-written page answering six questions beats a manual nobody reads.
1. Which tools are approved. A concrete list with names, not an abstract description. If someone wants a different one, there should be a simple route to request it.
2. What information can be uploaded and what can't. This is the most important clause. Three categories are enough: public, internal and confidential. For each, which tools may be used.
3. Which decisions require human review. Anything affecting people, anything leaving the organization, and anything with direct financial impact.
4. What has to be verified before using an output. Facts, citations, numbers and legal references. The practical rule: if you're signing your name to it, verify it.
5. How generated content is identified. If an external communication, report or content piece was produced with AI assistance, what transparency standard applies.
6. Who to ask. A name or a channel. Without it, people decide alone and the policy becomes decorative.
The trap of the restrictive policy
A policy that bans almost everything produces the opposite of what's intended: usage goes underground. People keep using the tools, but from personal devices and without any record — exactly the highest-risk scenario.
An effective policy enables with criteria. It states clearly what's allowed, provides approved alternatives where restrictions apply, and reserves prohibitions for what genuinely warrants them.
The three risks the policy must cover
Confidentiality. The most concrete and most frequent risk. Customer information, employee data, strategy, code, contracts. The policy should state which tools have a confidentiality agreement in place and which don't.
Accuracy. Models produce incorrect information in a confident tone. In legal, financial, technical or medical contexts, the cost of an error is high. Here the policy defines what gets verified and who signs off.
Decisions about people. Hiring, evaluation, promotion, access to services or benefits. These are regulated uses in several jurisdictions, and the legal exposure is real.
Who should write it
Not IT alone. The combination that works includes someone from legal, someone from information security, someone from operations, and someone who actually uses the tools every day.
That last person is the most important and the most often forgotten: without them, the policy ends up banning practices that already work well, or enabling things nobody needs.
Keeping it alive
An AI policy written a year ago and never revisited is nearly as risky as having none, because it creates a false sense of control while the tools change underneath.
A short quarterly review is enough: which new tools appeared, what questions came in, what incidents occurred, what needs adjusting.
The simplest starting point
If nothing is written today, a good first step is a one-page document with three lists: approved tools, information that never goes into any external tool, and uses that require prior approval. Circulate it, explain it in a fifteen-minute meeting, and leave a channel open for questions.
That covers most of the real risk, and it can be done this week.
Frequently asked questions
When should we write an AI usage policy?
Before informal use spreads — which in practice means now: in most organizations teams already use AI tools without guidelines. An early policy prevents incidents and creates predictability.
What should an AI policy prohibit?
Uploading confidential information or personal data into unapproved tools, making decisions about people without human review, and publishing generated content without verification. Everything else is better enabled with clear criteria.
Do we need an AI committee?
In medium and large organizations, yes — even a small one meeting monthly. Its job isn't approving every use, but maintaining the list of allowed tools, reviewing new cases and answering questions.