The policy you have isn't the problem. The policy nobody follows is.
A 2026 PagerDuty survey of 1,250 office professionals at companies with $500 million-plus in revenue found that two-thirds have used an AI tool at work they believed violated policy. Of those, 88% had shared work-related information with a public AI tool like ChatGPT, Claude or Gemini — 43% shared emails and correspondence, 34% entered customer data, and 31% shared financial information or confidential company documents. The twist is that 86% of respondents already worked somewhere with a formal AI policy in place. Having a document isn't the control; having one people actually read, understand and can comply with is.
Mid-market firms feel this gap more than either end of the market. A startup has little to lose and less to govern. A large enterprise has a compliance function dedicated to exactly this problem. A 50-to-500-person firm usually has neither — but carries real exposure: client contracts with confidentiality clauses, financial data, employee records, and increasingly, AI tools wired into actual business systems. That last part is a different problem from this one. This article is about the policy that governs what employees type into which AI tools, with what data, and under what review. If you're looking for guardrails on AI systems that act autonomously inside your business — placing orders, updating records, sending communications without a human approving each step — that's covered in our agentic AI governance framework; the two documents should reference each other, not duplicate each other.
What actually belongs in the policy
Skip the generic "use AI responsibly" preamble most templates lead with. A policy that changes behavior needs five concrete components.
1. An approved tool list, tied to a data classification
Not every AI tool handles data the same way. A free-tier consumer chatbot may retain and train on what's typed into it; an enterprise agreement with a zero-retention clause won't. Classify your data — public, internal, confidential, restricted — and state plainly which tier of tool each classification may touch. This single table does more risk reduction than the rest of the policy combined, because it turns an abstract judgment call ("is this okay to paste in?") into a lookup.
2. Human review requirements, by output type
Not everything an employee produces with AI needs the same scrutiny. A first draft of internal meeting notes needs none. A customer-facing email, a financial figure, legal language or an HR decision needs a named human reviewer before it goes anywhere. State the threshold explicitly rather than leaving it to individual judgment — that's what turns "I thought it was fine" into an actual policy violation instead of a gray area.
3. Confidentiality and client-data rules
This is where the PagerDuty numbers above should scare you: 34% of respondents had entered customer data into a public AI tool, and 31% had shared financial or confidential documents. For a firm with NDAs, client contracts or regulated data, that single behavior can trigger a breach-notification obligation. State it as a bright line, not a guideline: client and confidential data does not go into a public or free-tier AI tool, full stop, regardless of how useful the output would be.
4. Named accountability
"The AI made an error" is not a defense, and the policy should say so directly. The employee who used the tool is accountable for the output in the same way they'd be accountable for a spreadsheet error or a drafting mistake — AI is a tool they chose to use, not a third party they can defer responsibility to.
5. Mandatory onboarding, not a one-time memo
A policy emailed once and never discussed again has a half-life of about a quarter. Make a short training session — twenty minutes is enough — a condition of getting access to any approved AI tool, and repeat it whenever the tool list changes.
Borrow the governance backbone, skip the bureaucracy
You don't need to build a governance framework from nothing. Two reference points are worth knowing, for different reasons.
The NIST AI Risk Management Framework is free, voluntary, and organized around four functions that map cleanly onto a policy document: Govern — assign clear ownership of AI policy and decisions; Map — inventory where AI is actually being used, including the shadow use your survey will surface; Measure — define what you're tracking (incidents, data exposure events, tool adoption) and how; and Manage — the process for responding to problems and retiring tools or practices that aren't working. For most mid-market firms, structuring the policy around these four functions — without pursuing any formal certification — is the fastest way to look organized rather than improvised.
ISO/IEC 42001, published in 2023, is the world's first certifiable AI management system standard — the AI equivalent of ISO 27001 for information security. Most mid-market firms don't need certification. It becomes relevant the moment an enterprise or public-sector customer, particularly one in the EU or UK, starts asking for it in a vendor due-diligence questionnaire. If that's a realistic scenario for your pipeline within the next year or two, it's worth structuring your policy so a future certification push isn't a rewrite.
None of this is legal advice. Firms operating across multiple jurisdictions — the EU's AI Act, UK data protection rules, UAE and India's data residency requirements — should have counsel review the final document against the specific regulatory exposure in each market they operate in.
Tier the risk by use case, not by tool
The same AI tool can be low-risk or high-risk depending entirely on what it's being asked to do. Tiering by use case, rather than banning or approving entire tools, is what keeps the policy usable.
| Tier | Example use case | Review requirement |
|---|---|---|
| Low | Internal drafting, research, meeting summaries — no restricted data | Self-review; no sign-off needed |
| Medium | Customer-facing content, analysis feeding a business decision | Named reviewer sign-off before it's sent or published |
| High | Autonomous agents touching live systems; financial, legal or HR decisions | Formal approval gate and audit trail — see our agentic AI governance framework |
Most policies fail by being either too permissive (everything's fine, use your judgment) or too restrictive (nothing's approved, so nobody follows it and shadow use flourishes instead). A tiered structure gives employees a fast, specific answer for the situation in front of them, which is the entire point of writing the document down.
A 90-day rollout that doesn't stall
Policies that take a year to finalize are usually obsolete by the time they're published, because the tool landscape moves faster than that. A tighter sequence works better.
Days 1–30: Run an honest inventory of actual AI usage — a short anonymous survey plus a review of what's showing up in expense reports, browser extensions and IT logs will surface more shadow AI than anyone expects. Name a single owner for the policy. Draft version one using the five components above, scoped to what you actually found rather than a generic template.
Days 31–60: Pilot the policy with one or two departments before a company-wide rollout. Finalize the approved tool list, including moving any heavily used consumer tool to an enterprise or zero-retention agreement where the budget allows it. Run the first round of mandatory training with the pilot group and fix what doesn't land.
Days 61–90: Roll out company-wide, set a quarterly review cadence for the first year, and fold the policy into new-hire onboarding permanently. If you're running — or planning — a broader Technology & AI Audit, this is the natural point to connect the two: the audit tells you where AI is already touching your systems, and the policy governs how it's allowed to.
A policy nobody operationalizes isn't a safeguard — it's a liability with a PDF attached.
Frequently asked questions
Trust isn't the gap. PagerDuty's 2026 workplace survey found 86% of respondents already work somewhere with an AI policy in place, yet two-thirds admit using a tool they believed violated it. The problem is almost never intent — it's that the policy was never operationalized into an approved tool list, data rules and training people actually received.
An acceptable use policy governs what employees type into which AI tools, with what data, and under what review — day-to-day human use of chat-based AI. Agentic AI governance is a narrower, higher-stakes layer covering AI systems that act autonomously inside your business systems: approval gates, audit trails and rollback procedures for agents that can place orders, modify records or send communications without a human in the loop.
For most mid-market firms, NIST's AI Risk Management Framework is the more practical starting point — it's free, voluntary and gives you a structure (Govern, Map, Measure, Manage) without requiring certification. ISO/IEC 42001 becomes relevant once customers, particularly enterprise or public-sector buyers in the EU or UK, start asking for it in due diligence or RFPs; it's a certifiable standard, not just a reference framework.
Ownership should sit with a named individual, not a department, even if the drafting is cross-functional. IT or security typically owns the approved tool list and data controls, legal or compliance owns the regulatory language, and department heads own how AI is actually used in their workflows. One person needs to be accountable for keeping the document current, or it goes stale within a quarter.
Quarterly, at minimum, in the first year — the approved tool list and risk tiers will shift faster than any other part of your governance stack. After the first year, a semi-annual review is usually enough, with an off-cycle review triggered any time a new AI capability (a new agent, a new vendor tool) is introduced into a workflow.