AI policy
Also known as: AI use policy
What is AI policy?
The organisation's written rules for using AI: which tools are approved, what data must never go into them, when a human has to review the output. It is the first governance document most companies need, and the practical answer to shadow AI. Rules people can actually follow beat an exhaustive policy nobody reads.
Why it matters
Most AI policies fail the same way, and it is rarely because the rules were wrong. They are written once, filed on an intranet nobody visits, and never opened again until an incident sends someone looking. A rule people cannot recall is a rule that does not exist when the moment to follow it arrives. Two things separate a policy that works from a document that decorates a shared drive. It is short enough to hold in your head, and it keeps pace with tools that change every few months. A policy written for last year’s tools hands blanket permission to situations it never anticipated.
In practice
One team keeps its rules to a single page people actually read and revisits it each quarter as new tools arrive. Another produces a 40-page document, circulates it once and never mentions it again. When a novel situation lands, staff at the first company have a usable answer and staff at the second improvise. The living one-pager beats the thorough version nobody opens.
