The Policy Gap Nobody's Filled Yet
Most small and midsize organizations have a written policy for internet use, email, and remote access. Almost none have one for AI tools, even though employees are already using them. A customer service rep pastes a complaint into ChatGPT to draft a reply. A finance person uploads a spreadsheet to an AI tool to summarize it. A developer pipes a code snippet through an AI assistant that stores prompts for training. None of this is malicious. Most of it happens because it's faster than the alternative, and because nobody told them not to.
That's the gap: not a lack of AI use, but a lack of anything in writing that says what's allowed, what isn't, and where the lines actually are.
What the Policy Actually Needs to Cover
An AI acceptable use policy doesn't need to be long, but it does need to answer four questions clearly enough that an employee can act on them without asking first.
Which tools are approved, and which aren't
Name the tools your organization has actually reviewed and approved, not a blanket “AI is fine” or “AI is banned.” A named list is something people can actually check against. It also gives you something concrete to update as new tools show up, instead of rewriting the whole policy every time.
What data can never go into a prompt
This is the part that matters most and gets skipped most often. Be specific: customer records, financial data, health information, source code, contract terms, anything covered by an NDA. “Use good judgment” is not a control. A short, explicit list is.
Who approves a new AI tool before it's adopted
Someone should own this decision: IT, a designated security lead, whoever it is at your organization. New AI features are showing up inside software you already use, not just as standalone tools, so the approval process needs to cover both: a new app someone wants to install, and a new AI feature that quietly turns on inside an existing vendor product.
What happens when someone breaks the policy
This doesn't need to be punitive to be effective. It needs to be clear enough that a manager knows what to do the first time it happens, and consistent enough that it isn't decided case by case.
Why an Outright Ban Doesn't Work
Banning AI tools feels like the safe move, but it usually just removes visibility instead of removing risk. Employees who are told “no AI” don't stop using it. They move to personal accounts, personal devices, and browser extensions nobody approved, which is a harder problem to manage than the one you started with. A written policy that channels usage into approved, reviewed tools gives you something to actually govern. A ban you can't enforce gives you a false sense that the risk went away.
Keeping It Current
AI tools and vendor features change faster than most policies get reviewed. An annual calendar check isn't enough on its own. Pair it with an actual look at what's being used: new browser extensions, AI features vendors have quietly turned on by default, tools employees mention using that were never formally approved. The policy should reflect what's actually happening, not just what was true when it was written.
Need a Starting Point?
If you're not sure where AI is already being used in your business or what a policy should say once you know, the AI Cyber Risk & Governance Assessment is built to answer exactly that. Or reach out directly and we can talk through what fits your organization.