LR-101 · Module 3

AI Policies That Work

3 min read

Most AI policies fail because they are written to look responsible rather than to be useful. A 30-page acceptable use policy that nobody reads is not governance. It is theater. Effective AI policy is short, specific, and actionable. It tells people what they can do, what they cannot do, and what requires approval — in language clear enough that compliance does not require interpretation.

  1. Acceptable Use Policy Define what AI tools are approved, what data can be processed through them, and what use cases are explicitly prohibited. Be specific. "Employees may use approved AI tools for drafting, research, and analysis. Employees may not process customer PII, proprietary source code, or confidential financial data through external AI tools without written approval." That is a policy people can follow.
  2. Model Selection Criteria Not all AI models carry the same risk profile. Define criteria for evaluating and approving new AI tools: data handling practices, security certifications, output reliability for your use cases, and vendor stability. A model selection checklist prevents the slow accumulation of unevaluated tools across the organization.
  3. Data Handling Rules Classify your data into tiers (public, internal, confidential, restricted) and define which AI tools can process each tier. Restricted data never touches external AI. Confidential data requires approved enterprise-tier tools with data processing agreements. Internal data uses approved tools with standard protections. This is not complicated. It just needs to be written down.

Do This

  • Write policies that are short enough to read and specific enough to follow
  • Define data classification tiers and map them to approved AI tools
  • Include a clear approval process for new AI tools — who decides, and what criteria they use

Avoid This

  • Write a 30-page policy document that nobody will read and nobody will follow
  • Use vague language like "exercise appropriate judgment" — define what appropriate means
  • Let individual employees choose their own AI tools without organizational review