The AI usage policy your teams will actually follow

Every company now has employees using AI tools. Fewer have a policy those employees have actually read. The gap between written policy and daily behaviour is where data leaks and compliance findings live.

Why most AI policies fail

Two failure modes dominate. The blanket ban: nobody follows it, so usage goes underground and you lose all visibility. The blank cheque: everything is allowed, so customer data ends up in free-tier chatbots with training-on-input enabled. Both leave you worse off than no policy, because both create false confidence.

The three building blocks that work

First, an approved-tools list with named accounts. Not a category (AI assistants are fine) but specific products under enterprise agreements, with data-processing terms reviewed. Second, a simple data classification: public, internal, confidential. Map each class to what may go into which tool — public anything, internal into approved enterprise tools, confidential nowhere without a specific sign-off. Third, a fast path to yes: a one-page request form with a five-working-day SLA for approving a new tool. Slow approval is the number-one driver of shadow AI.

Keep it to two pages

If your policy needs a legal team to parse, it will not be read. Two pages: what is allowed, what is not, how to request something new, and who to ask. Link the detailed legal annex if you must, but the operational rule must fit on a screen.

Enforce with visibility, not punishment

Pair the policy with a gateway or proxy that shows which tools are actually being used. When teams see that usage is visible — not blocked, just visible — compliance rises sharply. Reserve escalation for confidential-data violations, and treat the first offence as a training gap, not a disciplinary case.

The takeaway

A good AI usage policy is short, specific, and has a fast approval path. Write the two pages this quarter — before your auditor or a customer's security questionnaire asks for them.