Blog · · 4 min read
AI usage policy: what it is and what happens without one
What an AI usage policy actually is
It's more than a list of what staff can and can't do. A proper AI usage policy sets out what AI is actually for in your business, the tasks it's approved for, the ones it's not, and what data is off limits. But it also has to cover how AI gets adopted, not just how it's used once it's already there.
That matters because AI adoption isn't really a technology rollout. It's a cultural change. People need to trust the tool, understand where it helps and where it doesn't, and know the rules will keep making sense as the tools themselves change. A policy that's just a rulebook, written once and left alone, doesn't hold up to that.
What happens when it's skipped
This actually happened. In 2023, engineers at Samsung's semiconductor division started using ChatGPT to help with day to day work. Within about three weeks there were three separate incidents. One engineer pasted in confidential source code to help fix a bug. Another used it to optimise code for spotting defective chips. A third fed it a recording of an internal meeting to get the minutes written up.
None of them were trying to cause harm. They were just trying to get their jobs done faster, and nobody had told them not to.
Once that data went into ChatGPT, Samsung couldn't get it back. It was sitting on a third party's servers with no way to delete it. The company ended up banning generative AI tools for staff altogether, and they weren't the only ones. Amazon and Walmart issued similar warnings to their own staff around the same time.
That's the real risk. Not one big dramatic breach, just ordinary staff doing their jobs, quietly sending out the things a business can least afford to lose.
How not to do it
A few patterns show up again and again in businesses that get this wrong.
- Banning AI outright and calling that a policy. Samsung's response was a blanket ban, and it's an understandable reaction, but it doesn't solve the underlying problem. Staff still need to get their work done, so the usage just goes underground instead of disappearing. You lose visibility without actually removing the risk.
- Rolling it out top down with no input from the people using it. Leadership picks a tool, sends round an email, and expects everyone to fall in line. No training, no chance to ask questions, no feedback loop. Adoption stalls or people quietly ignore it, because nobody addressed the cultural side of the change.
- Treating it as a one off project instead of something ongoing. A policy gets written, signed off, and filed away. Six months later the tools have moved on, staff have found new use cases nobody anticipated, and the policy hasn't kept up. Nothing about AI stays still for long, so nothing about how you govern it should either.
- No clear ownership. Nobody's actually responsible for reviewing how AI is being used, approving new tools, or fielding questions when something doesn't feel right. Without an owner, the policy has no way to evolve, so it quietly stops being followed.
What good looks like
A good AI policy reads more like an operating model than a rulebook. It sets out acceptable use, what AI can genuinely help with and where it has no business being involved, and it treats the rollout itself as something that needs managing, not just switched on.
That means governance: someone actually owns the policy, decisions about new tools or use cases go through a real process, and staff have somewhere to raise questions or flag something that feels off. It also means control, knowing which tools are in use, what data they touch, and being able to step in if something's not working as intended.
And it means treating the whole thing the way you'd treat any other piece of software running in the business: not a one off decision, but something reviewed and improved over time as tools change, staff get more comfortable, and new risks or opportunities show up. Set it once and it's out of date within months.
Where do you stand?
This is one of 22 questions in AngleYou's AI Readiness Assessment, covering technology, data, security, people and governance.