Why Every Business Needs an AI Policy

ByEmily Dolloff

Are employees at your company surreptitiously using artificial intelligence tools like ChatGPT, Claude, Copilot, and Gemini for everyday business tasks? It’s likely. An October 2024 Software AG study found that half of all employees use “shadow AI” tools to enhance their productivity, and most would continue using them even if explicitly banned by their employer.

Increased productivity is a good thing, but unsanctioned and unregulated AI use poses risks. A February 2025 TELUS Digital survey found that 57% of enterprise employees admit to entering high-risk information into publicly available chatbots. This includes personal data about employees or customers, product or project details, and confidential financial information like revenues, profit margins, budgets, and forecasts.

A clear AI policy will help a business minimize the risks of using AI tools. These risks include leaks of confidential information, compliance failures, accidental copyright violations, and reputational damage. As AI becomes a routine part of knowledge work, every business—even small firms—must establish an AI policy to maximize the benefits of using AI while safeguarding the company, its employees, and its clients.

Risks Addressed by a Formal AI Policy

Unauthorized AI use can create several types of problems:

  • Data security: Employees routinely paste sensitive data—including customer information, financial records, and unreleased products—into public AI tools, thereby losing control over how that data is used. That can make security audits nearly impossible and drive IT staff crazy. Notably, the free versions of ChatGPT (by default, it can be turned off) and Google’s Gemini can incorporate user data into their training models, making it possible that the information could be included in a discussion with someone else.
  • Legal and compliance risks: Sharing protected information with non-compliant AI systems could result in penalties during regulatory audits, even if no actual data breach or harm occurs. For instance, using such systems to summarize patient records could violate HIPAA, while using them to analyze customer data could run afoul of the California Consumer Privacy Act (CCPA).
  • Unintentional discrimination: Without clear guidelines, the use of AI can lead to unintentional discrimination in hiring, customer service, and decision-making. This may violate ethical standards and expose the company to legal liability.
  • Employee confusion: The lack of a coherent AI policy leads to inconsistent practices and uncertainty about acceptable tools and proper procedures, resulting in reduced productivity and increased anxiety about AI use.

Essential Elements of an AI Policy

The specifics of an AI policy vary by the type and size of company, but at minimum, most AI policies should include the following:

  • Permitted AI uses and tools: Clear guidelines on the types of tasks employees may undertake with AI assistance and a list of approved AI platforms for business activities
  • Data privacy and legal compliance: Rules for safeguarding confidential, personal, and proprietary information when using AI, coupled with rules that ensure adherence to relevant industry-specific regulations and privacy laws
  • Human oversight and transparency: Requirements that employees thoroughly review AI-generated content before use and disclose AI involvement when appropriate in client-facing or public materials
  • Risk reporting and incident response: Clear instructions for reporting AI-related errors, security incidents, or potential misuses
  • Ownership and intellectual property clarifications: Statements affirming that work products created with AI assistance belong to the company. These statements should also address any intellectual property considerations.

Building Your AI Policy

If your company doesn’t already have an established process for generating policies, AI tools can themselves provide a starting point when used thoughtfully. Here’s an approach:

  1. Prompt an AI tool like ChatGPT or Claude to generate a basic AI policy template. Be explicit about your company’s size, industry, and other relevant details, and be sure to specify that it must cover the elements listed above—you can paste them in. Iterate as necessary until the template has all the required sections.
  2. Review the generated template carefully, removing generic content and noting areas that need company-specific details.
  3. Ask for feedback on the draft from key stakeholders, including:
    • Leadership to align with company goals and values
    • IT team to verify technical feasibility and security measures
    • Legal counsel to ensure compliance with relevant regulations
    • Department heads to confirm that it will be practical to implement the policy
  4. Incorporate the feedback to create a policy that reflects your company’s specific needs while maintaining necessary protections.

Remember: An AI-generated template is for starting the conversation. The final policy must be tailored to your organization’s specific needs and thoroughly vetted by relevant stakeholders.

The rise of AI tools in the workplace isn’t just a trend—it’s a fundamental shift in how work gets done. Whether your employees are already using AI tools without oversight or are hesitant to use them due to uncertainty, now is the time to establish a formal AI policy. Start with the template approach outlined above, engage your stakeholders, and develop guidelines that work for your organization. A well-crafted AI policy will help your business harness the benefits of AI while minimizing its risks.

(Featured image by iStock.com/girafchik123)

Social Media: Shadow AI is commonplace in workplaces, with half of employees using unauthorized AI tools and many sharing sensitive data. Learn why your business needs a formal AI policy to harness the benefits of AI while safeguarding against its significant risks.

Similar Posts

  • _Dear Friends,_

    Baseball season is almost upon us as spring training wraps up and the real games begin next week. The hopes for the Chicago Cubs have never been higher with a great line-up and pitching. Could this be our year? To help matters along, Apple and MLB announced this week that they have struck a multi-year deal to supply 12.9 inch iPad Pros with special STM team-logoed cases and a custom app called MLB Dugout. This app will help managers see performance statistics, check videos from games and analyze how pitchers and hitters are likely to perform against each other.

    Baseball has become a game of statistics and until this deal laptops, iPads and iPhones were banned from dugouts. That ban is gone as iPad Pros will replace the notebooks and photographs in big binders. Each team’s data will be downloaded to the iPads before the games. I can see this really speeding up the research about how to play a certain batter or what kind of stuff a pitcher has. Cubs manager, Joe Maddon, is not so sure “This might sound nuts to you, bit it might slow down the process. If there’s that moment that permits time to look up something, it might be OK, but I think thats where the piece of paper has it all over the computer–in that moment.” Well, Joe you are a hell of a manager but I’ll put the iPad Pro up against your binder any day! Fortunately, MLB didn’t ban paper so Joe is all set.

    I have talked many times about being a socially responsible business but this week we saw the power for good that businesses can use. While not yet successful in overturning the North Carolina law that legalizes discrimination against LGBT people, business pressure stopped a similar law in Georgia and the list of businesses lining up for repeal in NC is impressive. It was business that turned the tide when civil unions were first introduced in Vermont and it can be business again that dope-slaps some sense into these backwards legislatures, too.

    This week’s Kibbles & Bytes exclusive features the iPad mini 4 in Space Gray. This 64GB model features Wi-Fi and Cellular and comes with the AppleCare+ protection plan that increases the hardware warranty from 1 to 2 years, technical support from 90-days to 2-years and provides for accidental damage coverage. This is the latest iPad mini that features the Retina display. With 64GB of ram and cellular capability you will never be out of touch. Normally, this bundle is $730 but this week exclusively for Kibbles & Bytes readers you get the “**iPad mini 4 64GB Wi-Fi and Cellular with AppleCare+ for $50 off**”:http://www.smalldog.com/wag900002186 at “**$679.99!**”:http://www.smalldog.com/wag900002186/

  • Lift Objects from Photos on the iPhone

    Have you ever wanted to extract an object from a photo for use in another context? Starting with iOS 16 on a relatively…

  • My daughter Autumn and her husband Ismael are coming to visit next week which should be fun. Then we pack up and head back to Vermont. Hopefully the weather will cooperate but it seems like warmer weather is in the forecast for the Green Mountains.

    Thank you so much for reading this issue of Kibbles & Bytes!

    Your Kibbles & Bytes Team,

    _Don, Emily, Hadley & Amy_

  • Apple TV and Apple Watch

    This week I’ve been testing out some of the new features on the Apple TV and a bit on the new watchOS. You can now get an Apple Watch for $299.99. The release of watchOS 2.2 was a minor bump in improvements, including the ability to pair more than one Apple Watch to one iPhone, additional browsing options in Maps, improvements to tracking your pulse and a few other minor updates. Unlike past revisions and improvements to the watchOS this one has left me feeling a little underwhelmed. While the software updates weren’t particularly robust, I was excited to see that the Apple Watch now has even more watch bands to choose from. I’ve had my watch for about six months now and have noticed its getting a bit dingy, so now might be a good time to get another band! There are new sport band colors to choose from including a bold new yellow and a new woven nylon option. For those seeking a more traditional style band, the woven nylon might be just what you are looking for, this band features a standard watch buckle style clasp.

    Apple TV got some updates this week and just in time for the NCAA Championship. With the latest software release for Apple TV you can now get the latest NCAA games with an added feature of having two games display on your TV side by side! In addition to being able to watch the latest games, you now have approximately 5000 apps to choose from, including new workout apps. Siri now works better when searching for content, even in the App Store, and you can access your iCloud Photo library. Starting to feel like your apps are getting too cluttered? Easily create folders by dropping app icons onto of each other just like you do on your iPhone or iPad. Dictation, another added feature that can really speak up your search process. Rather than typing through letters one at a time when searching for something specific, you can now use dictation by selecting the Siri button in the search field. I will note, you do have to be in the specific search field, you can’t just use it from the home screen. My favorite updates, one of which works with both the Apple TV and the Apple watch, is the remote app. You can now use your Apple watch to navigate through the options on the Apple TV, a feature that might seem silly to some, but with a small and easily misplaced remote this is bound to be an incredibly valuable new feature. Think the watch is too small to use for a remote? Hook up your Apple bluetooth keyboard! That’s right, you can now use your standard sized keyboard as well.

    I should note, that some of these updates, like the NCAA games, do have additional fees. More and more of us are swaying away from traditional TV and with more options coming to the Apple TV and choosing your content, we are getting closer and closer to paying for only what we want.