Whether or not your company has an AI policy, your people are almost certainly using AI tools already: drafting emails, summarizing documents, cleaning up spreadsheets. That is mostly good news. The risk is that it is happening without guardrails, on personal accounts, with company and client data pasted into tools nobody has reviewed.
Governance doesn’t have to slow anyone down. The goal is to make the safe way the easy way. Here is the checklist we work through with clients before a broader rollout.
1. Find out what’s already in use
Start with an honest inventory. Survey teams, review sign-ins and browser extensions, and check which AI features are already switched on inside tools you own. You can’t govern what you can’t see.
2. Classify your data
Decide which information can go into which tools. A simple three-tier model works for most companies:
- Public: fine to use with any approved tool.
- Internal: only in business-licensed tools with appropriate data-protection terms.
- Restricted (client data, financials, HR, regulated information): only in specifically approved, configured environments, or not at all.
3. Choose approved tools and license them properly
Business and enterprise plans typically offer stronger commitments around how your data is handled than free consumer versions. Pick a small set of approved tools, buy the right licenses, and connect them to your identity provider so access is controlled and can be revoked.
4. Write a one-page acceptable use policy
Keep it short enough that people will read it: which tools are approved, what data can go where, the expectation that a person reviews AI output before it reaches a client, and who to ask when in doubt.
5. Prepare your permissions before you connect AI to your files
AI assistants that work across your documents respect existing permissions, which means they will also surface anything that was overshared years ago. Before connecting an assistant to SharePoint or file shares, review who can see what.
6. Start with a few high-value use cases
Rather than “AI for everything,” pick two or three workflows where the time savings are measurable: proposal drafting, ticket summarization, invoice processing. Measure before and after, then expand what works.
7. Review on a schedule
Tools, licensing terms and regulations change quickly. Revisit your approved list and policy at least twice a year.
Getting help
Our AI & Automation practice runs readiness assessments that cover all seven steps and finish with a prioritized plan. Let’s talk about where AI fits in your business.
