Your staff are already using AI. Write the policy anyway.
Almost every business we look at has ungoverned AI use somewhere in it. Banning it fails. Ignoring it costs more. Here is the middle path.
Harriet Bishop, Founder, Archetype
Former Director of AI and strategy consultant. Founder of Archetype.
The same pattern turns up in nearly every business we audit, whatever the sector. Somebody in finance is pasting supplier data into a chatbot to reformat it. Somebody in marketing is drafting customer emails with a tool nobody approved. Somebody in operations built a spreadsheet automation that half the team now depends on and nobody else understands.
None of these people are being reckless. They are solving a real problem with the fastest tool available. The risk is not that they are using AI. It is that nobody has told them where the edges are.
Why banning it does not work
Businesses that ban AI outright do not stop AI use. They stop visible AI use. Staff move from the company laptop to their phone, from the corporate account to a personal one, and the organisation loses the only thing it had going for it, the ability to see what is happening.
A ban also puts you at a straightforward commercial disadvantage against competitors who did the harder work of governing it properly.
What a usable policy actually contains
Most AI policies fail because they are written by people protecting the organisation from its staff, rather than helping its staff do their jobs. A policy nobody reads governs nothing. Keep it to two pages and cover five things.
- What is allowed by default. Name the specific tools people may use and for what. Vagueness here is what pushes people underground.
- What never goes in. Customer personal data, anything under NDA, credentials, unreleased financials, medical or legal detail about identifiable people. Be concrete, 'confidential information' means nothing to someone in a hurry.
- What has to be checked before it leaves the building. Anything client-facing, anything with a number in it, anything that would embarrass you if it were wrong.
- Who to ask. A named person, not a mailbox. Most policy breaches are someone guessing because asking looked slow.
- What happens if someone gets it wrong. If the answer is disciplinary action, nobody will report a mistake and you will find out from the client instead.
The five questions leadership should be able to answer
Very few leadership teams can answer all five. That is not a failure of governance so much as a symptom of how quickly this arrived. But the gap between the first question and the last is where most of the real risk sits.
- Which AI tools are being paid for by this business right now, and by which budget?
- Which AI tools are being used but not paid for?
- Has any customer or employee personal data been put into one of them?
- If a customer asked whether AI touched their work, what would we say?
- Who owns this question, genuinely, with time allocated to it?
Where to start
Before writing anything, find out what is actually happening. A short, non-punitive survey, 'tell us what you use, nobody is in trouble', will surface more in a week than a policy will govern in a year. Write the policy against what you find, not against what you imagine.