Here’s a hypothetical worth walking through. A company bans three AI chatbots by name and circulates a one-page memo saying so. A month later, an accounts payable clerk uses an assistant that isn’t on the list to clean up a vendor spreadsheet with bank details in it. He followed the policy exactly. The policy just never told him what he needed to know.
A banned list answers one narrow question. Employees face dozens of others every week, and new tools appear faster than anyone can add names to a memo. A useful policy explains how to decide, so people can make the right call when they hit something the policy’s author never imagined.
I co-founded Cocha Technology, a Houston-based consultancy focused on AI governance and Microsoft 365 data security for law firms and mid-market organizations. The policies I find most workable cover five decisions, written in language a new hire can follow on day one.
Name what’s approved, down to the account
Listing approved tools is a start. The account type matters just as much. The same AI product can come with very different data handling terms depending on whether someone signs in with a personal email or a company-managed account, and a business has far less visibility into the personal one.
So be specific. Say which tools are approved and that staff must sign in with their company identity. Then say what happens to anything else, whether that means asking IT first or that it’s off limits for company work. People will follow a clear path when one exists.
Sort information by what can go in
Most accidental exposure happens at the moment someone pastes or uploads. The policy should spell out what’s allowed in plain categories that match how your business already labels information. Public marketing copy might be fine anywhere. Internal planning documents might be fine only in approved company tools. Customer financial data, employee records, and anything covered by a contract or confidentiality obligation might be off limits unless a specific workflow has been reviewed.
Give examples from your own business. Picture a project manager at a construction firm deciding whether to paste a subcontractor bid into an assistant to compare pricing. A line that says no confidential data won’t settle that for her. A line that says bids and pricing from outside parties stay out of AI tools unless the tool is approved for contract documents will.
Put one person in charge of connections
Many AI assistants can now plug into email, file storage, calendars, and business applications. Each connection widens what the tool can see and sometimes what it can do. An employee who links an assistant to a shared drive may be giving it reach far beyond the one folder they had in mind.
Your policy should state that connecting an AI tool to any company system requires approval, and it should name who grants it. A role is fine. Naming the whole IT department is too vague. Employees need to know who to ask and roughly how long an answer takes, or they’ll find a way around the process.
Say when a person has to check the work
AI output can be confidently wrong, and some tools can now take actions on their own. The policy should identify where a human signs off before anything goes further. Client-facing documents, figures that feed financial reporting, hiring decisions, and anything sent outside the company under someone’s name are reasonable candidates.
Be precise about what review means. Skimming a draft for typos is different from checking every number against the source. Where accuracy matters, say so.
Make reporting easy and safe
Someone will paste the wrong file. A hypothetical sales rep uploads a client contract to an unapproved tool, realizes it ten minutes later, and has to decide whether to tell anyone. If the policy is silent or the culture punishes honesty, that mistake stays hidden and nobody can respond to it.
Give people one place to report an accidental disclosure, tell them what details to include, and make clear that prompt reporting is expected. Use the same channel for exception requests. A team that needs a tool the policy doesn’t cover should have a legitimate way to ask, so the request comes to you instead of happening quietly.
Keep it current
A policy written for the tools available this spring may be stale by fall. Assign an owner and a review date, and update it when you approve a new tool or a vendor changes how its product works.
This week
Ask five employees from different departments which AI tools they used for work in the past month and what they put into them. Don’t make it a compliance audit. Use their answers to write the first draft of your information categories, based on what your people are already doing rather than what you assume they’re doing.
