A company recently described their AI policy to me in three sentences: no PII, no trade secrets, no customer data. Their board had wanted the thorough version, covering who can use AI, when they can use it and which models are allowed. They talked the board out of it, because anything that specific would be wrong within six months.
They’re right about the shelf life. But vague policies have a hidden cost: they stall adoption.
Silence reads as a no
In the regulated companies I’ve worked with, most employees aren’t trying to sneak customer data into ChatGPT. They want to use AI in their work, and they’re waiting for someone to tell them which tools they’re allowed to use. Their policy doesn’t name the tool they’ve heard about, so they take the silence as a no. They keep doing the work the slow way, and leadership decides the team just isn’t interested in AI.
Name the tool, and that changes the same week. When people see “Claude Team” or “Microsoft 365 Copilot” written into their own company’s policy, they have a green light they can point to.
Adoption follows permission.
Name the tier, too
One line has survived every policy I’ve written: the paid plan is required, and the free consumer version is prohibited. Anthropic, OpenAI and Google all commit to not training on your data when you’re on a business plan. They make no such promise on the free tier. “Use AI responsibly” gives people nothing. “Use the company account, never the free one on your personal email” covers most of your real exposure in one line.
Separate security risk from reputation risk
Someone once pushed back on a draft of mine. If we’re paying for an enterprise tool, why ban pricing and contract details? On security, he had a point, because the privacy terms on paid plans are enough. The bigger risk is reputation. Some of his customers compete with each other. If one of them learned its pricing had gone into an AI tool, “the privacy policy covers it” is not a conversation you want to have. Separate those two risks before you write the rule.
Four questions, one sentence each
Here’s a version you can finish Monday morning. Answer four questions, one sentence each:
- What’s approved? Give the actual product names and plans.
- What never goes in? List categories, not every example: customer PII, employee records, anything under NDA, unreleased financials.
- Who approves new tools? Name one person. With a committee, the answer arrives eight weeks later, after your team has already decided for itself.
- Who do I ask? Name one person, and make sure they know their name is on it.
Send it to your leadership team today and to everyone else this week.
The comprehensive version still has a job
I’ve written the comprehensive version too, with data classification tiers and appendices. If your company has real regulatory exposure, you’ll eventually need one. (Here’s what a fuller AI governance posture looks like for a mid-market business.) But its value was in shaping the conversation. It was never the thing that shipped.
The four sentences are what ships. You’ll revise them in three months, and that’s fine. An imperfect policy your people have read beats a perfect one stuck in legal review.
Most people get stuck on the first question: which tools their team should be using, and what that will cost. We help companies work through that often, so reach out if it would help to talk it over.
What’s your company’s AI policy right now, and could anyone on your team recite it?
This piece first ran in First Bite, Frogslayer’s monthly newsletter for business leaders: one idea a month to sit with, test, or pass along.