Approved tools, clear data boundaries, and a review cycle — written in language staff understand, because a policy nobody reads governs nothing.
The Real Problem
“Do not put confidential information into AI tools” sounds responsible and tells nobody anything. Is a client’s name confidential? A contract clause with identifiers removed? A support ticket? Staff facing an ambiguous rule and a genuinely useful tool will resolve the ambiguity in favour of getting work done — and they’ll be right to, because nobody told them where the line actually sits.
Useful governance names tools, names data categories, and gives examples. It’s longer to write and vastly more likely to be followed.
What’s Included
A real picture of which tools are in use, by whom, and for what — before any rules are written.
Specific categories with specific answers, rather than an undefined word like confidential.
Evaluation of retention, training, and jurisdiction terms, producing a list staff can actually work from.
Plain-language rules with worked examples, sized to be read rather than filed.
Practical guidance on effective and compliant use, which does more for adoption than any prohibition.
Scheduled reassessment, because vendor terms in this category change faster than annual policy reviews.
Common Questions
Increasingly, sector rules and client contracts ask how AI is governed. Even where nothing mandates it, insurers and enterprise customers are starting to ask.
More often than most policies — quarterly is reasonable, because model terms and capabilities shift constantly.
Test it: can staff tell whether a client email may be pasted into a chatbot? If not, it needs work.
