AI Use Policy Development
Most organizations don't have a written AI use policy at all — only 44% do, and fewer still have one anyone actually reads. I write AI use policy that's specific enough to be enforceable: what tools are approved, what data can touch them, and who signs off before a new one gets adopted. I built this same discipline into Autodesk's third-party AI risk program, where policy had to hold up against real vendor evaluations, not just live in a wiki.
What this covers
Policy drafting & approval workflow
Actual policy language tied to a real sign-off process, not a generic template pulled from a search result.
Approved-tool list & data classification
What's allowed, what data can touch it, and a process for updating the list as new tools appear.
Shadow-AI discovery
Finding out what's already being used before writing policy for what you assume is being used.
Policy communication & rollout
The difference between a policy that exists and one people have actually seen and understood.
Exception handling
A defined path for when a team needs a tool the policy doesn't yet cover, instead of a silent workaround.
Who this is for
Organizations where different teams have already started using AI tools without anyone deciding what's allowed — the majority of organizations that still lack a written AI use policy at all. Especially relevant when a customer security questionnaire, or a new hire's first week, makes clear nobody's actually decided what's approved.
Have this problem right now?
I take on a limited number of clients at a time so every engagement gets real attention. Let's talk about scope, cadence, and fit.
Book an introductory call