Do we need an AI policy for our staff?
Yes, and a short one is enough: one or two pages that say which AI tools staff may use for work, what data may go into them, and who checks the output. Your staff are almost certainly using AI already, so the choice is not whether they use it but whether they use it on accounts your company controls.
Evidence
WASBuilder is a system where AI agents write and ship software under written rules, with a person approving every change before it goes out. The rules are what make the agents' work safe to ship. HARchive keeps a private video archive out of cloud tools entirely, because a written rule says that footage never leaves the laptop.
- 665 of 681 WASBuilder tickets created were shipped to production
- 17.4% of WASBuilder tickets needed any rework at all
- 440 hours of raw video indexed without a frame leaving the laptop
Read the full stories in the WASBuilder and HARchive case studies.
Most companies use AI, few govern it
Netrio's 2026 survey of mid-market firms found that most already use AI somewhere, but only 26% have it scaled and governed. In the rest, AI arrived one employee at a time: someone tried ChatGPT for an email, a team signed up for a transcription tool, and nobody decided which of it was fine.
That gap is where the risk sits. It is rarely the tool itself. It is company data going into an account the company does not own, and AI output going to a client without anyone reading it.
What a short AI policy contains
For a company of 50 to 500 people, a policy that staff will actually read fits on one or two pages and answers five things:
- Approved tools and plans. Which tools staff may use for work, and on which plan: for example ChatGPT Business or Microsoft 365 Copilot signed in with a work account, and never a free or personal account.
- Which data may and may not go in. What is fine to paste into an approved tool, such as drafts and public material, and what is not, such as client personal information, passwords and anything a contract says stays private.
- Human review of output. A person reads and stands behind anything AI wrote before it goes to a client, into a contract or into production.
- Who owns the policy. One named person who answers questions, keeps the list of tools up to date and reviews the policy every few months, because the tools change that often.
- How to ask for a new tool. A short, quick way for staff to request a tool that is not on the list, so the answer to "can I use this?" takes days rather than never.
Everything else, from training to which teams use which features, can follow once these five are written down.
Shadow AI, and why a ban makes it worse
Shadow AI is staff using AI on personal accounts or tools the company has not approved. It is usually well meant: people find that AI saves them an hour, and use whatever they can sign up for. But what they paste in sits outside any agreement your company has with the vendor, on settings your company cannot see or change, and it leaves with them when they do.
Banning AI does not stop this. It moves it to phones and home laptops, where nobody can see it, and it tells staff not to ask. A policy that approves a good tool on a business plan gives them a better option than the personal account, and gives the company back the control a ban only pretends to have.
Next step
Tell me which AI tools your staff use today and what data they work with, and I will tell you plainly what your policy needs to say, which plan to standardise on, and where the real risks are.