AI usage policy: framing shadow AI in 2 pages

Shadow AI is already inside your company

A large majority of employees use generative AI at work, and nearly half do so on tools their company never approved. It is not disobedience, it is a reflex: the tool is useful, no one said what to do, so everyone improvises. The problem is not AI. It is that a quote, a contract or a customer file can end up pasted into a free service without you knowing.

Banning does not work, framing does

The natural reaction is to block everything. Except that a ban simply pushes usage into the shadows, onto the personal phone or the personal account. You then lose the little visibility you had left. A short policy does the opposite: it clearly states what is allowed, what is not, and which tools to turn to.

What a 2-page policy contains

• What never leaves: the data never to paste into a public AI tool, in plain language.
• The approved tools: a short list of authorized tools, and why.
• The when-in-doubt rule: who to contact if you hesitate, in one line.
• What we always check: an AI answer is reread before it is sent to a customer or signed.
• The minimum literacy: one page so everyone understands what an AI can make up, which meets the spirit of the first AI Act obligation already in force, without turning it into a training project.

A policy no one reads protects no one. Two pages people understand beat thirty they file away.

Where the policy stops, and what comes next

Let us be clear: a policy sets rules, it does not enforce them on its own. It does not replace sovereign tools where your data stays with you. It is a starting point, deliberately light. I help you write it and explain it to your teams in a two-hour workshop. Then, if the topic deserves it, we look at how to give your teams an internal AI tool, on your data, that no one needs to work around anymore.