Your AI acceptable use policy is being written right now, one employee at a time, by whoever decided what to paste into a chatbot this morning.
That is not a criticism of your team. It is what happens when a genuinely useful tool arrives faster than anyone can write rules for it. For example, someone pastes in a client email to get help drafting a reply. Meanwhile, someone else runs a spreadsheet through it to find the pattern they have been staring at for an hour. Both of them saved time, and neither did anything they were told not to do, because nobody told them anything.
The term for this is shadow AI: AI use an organisation cannot see. The problem with invisible use is not that it is malicious. Rather, you cannot approve, support or improve what you do not know is happening.
This Is a Governance Gap, Not a Security Failure
It is tempting to treat this as a security problem and reach for a block. However, most organisations that try discover the same thing within a month: people use the tools on their phones instead. You have not removed the use, only your visibility into it.
The more useful question is the governance one. Governance sounds like paperwork, but it is really the answer to four questions:
- Who is responsible for deciding which AI tools are allowed?
- What are the rules about what information can go into them?
- Which risks apply to this business?
- How does a new tool get approved, and how often does that list get revisited?
Most businesses cannot answer all four. That is the gap, and it is closeable in an afternoon.
What an AI Acceptable Use Policy Actually Contains
A usable policy is one page. Anything longer does not get read, and a policy nobody reads is the same as no policy.
Approved tools. A short list of what your organisation is willing to use, and the name of the person who maintains it. The list matters less than the fact that one exists.
Information classification. This is the section people find hardest, and the one that does the most work. Use three buckets: what may never be entered into a public AI tool, what may be entered with care, and what is fine. For most businesses, the first bucket contains client information, financial records, employee data and anything covered by a contract or regulation.
Human review. This covers where AI output has to be checked before it is used or sent. Usually that means anything going to a client, anything with a number in it, and anything with legal weight.
Contractual obligations. Many businesses have already promised clients things about data handling. As a result, those promises limit which tools are acceptable, so read your own agreements before writing the policy.
Requesting a new tool. You need a route for asking. Without one, people go around.
Review cadence. Review quarterly, because this field moves too quickly for an annual review.
The Three Decisions Only You Can Make
A template can do most of this work for you. However, three things it cannot decide:
- Which tools go on the approved list
- What counts as sensitive in your specific business
- Who owns the list once it exists
That last one is where most policies quietly die. A policy without a named owner is a document, not a rule.
What has to be True Underneath
A policy tells people what the rules are, but whether you can follow them depends on what sits beneath it. Without control over who has accounts, a rule about who may use a tool does not mean much. Likewise, if nobody has written down how your systems work, no AI can help with them, and neither can a new hire. And when there are devices on your network you do not manage, you cannot govern what runs on them.
This is the unglamorous reason most AI projects stall: the problem is rarely the model, but the foundation underneath it.
Start with the Conversation
Before writing anything, ask your team what they are already using. Frame it as curiosity rather than an audit, because you get honest answers exactly once.
Then write down the tools you are willing to approve, fill in what counts as sensitive in your business, and tell people who to ask. Those four steps eliminate most shadow AI use, and none of them require a project.
We have put the template we use with clients into a document you can download and issue under your own name. It has no branding, and the only things left to fill in are the decisions that are yours.
