A first AI policy is usually a page of do's and don'ts. At scale, it becomes a living system: rules, tools, training, support and review that keep up with fast change.
What a mature policy covers
- Purpose and principles: why the company uses AI and the values that guide it.
- Approved tools: a list, and how to request new ones.
- Data rules: which data classes may go into which tools.
- Disclosure: when to tell colleagues, customers or candidates that AI was used.
- Human review: outputs that must be checked, and decisions AI may never make.
- Banned uses: for example emotion recognition, covert monitoring, decisions about people without human review.
- Responsibilities: employees, managers, HR, IT/security, legal.
- Training: what is required, by role.
- Where to ask: a named contact or channel.
- Review cycle: at least twice a year, with a short "what changed" note.
From ban to managed use
In May 2023 Samsung told staff at one of its biggest divisions that use of generative AI tools on company devices and networks was banned after engineers uploaded sensitive data, warning of disciplinary action up to termination; the company later clarified that the ban was temporary while it built safer options. Many early bans followed the same arc: ban → secure tools → policy and training → managed use.
Different rules for different risk
- Low risk (drafting internal text from public information): free use with approved tools.
- Medium risk (customer-facing content, internal confidential data): approved tools, review before use, disclosure where needed.
- High risk (decisions about people, personal data, regulated processes): formal approval, testing, human decision, logs.
Make it usable
One page for everyone, with an FAQ and examples from real jobs; detailed standards for specialists. Test it with employees before publishing.