There’s a pattern we keep seeing in almost every company we’ve spoken to lately. Someone on the team discovers ChatGPT and starts using it to draft emails. Someone else uses it to summarize meetings. Marketing brings it into campaigns. Sales uses it to qualify leads. And suddenly, without anyone having formally decided it, your company is using AI everywhere — with no rules, no oversight, and no idea what data is leaving the building.
This week, an article titled Have a Coherent AI Policy has been making the rounds on Hacker News and sparking plenty of debate. The thesis is simple but uncomfortable: most organizations are adopting AI without stopping to think about what they want AI to do (and not do) inside their business. The result is a mix of runaway enthusiasm and reactive bans that protects no one and frustrates everyone.
Let’s break down why this matters, what happens when you don’t have a clear policy, and how to build one that actually works.
The problem: AI is already in your company, whether you know it or not
According to recent studies, more than 75% of office workers use generative AI in their jobs. Of that group, a huge majority do so without their company officially knowing. This is known as "Shadow AI" — the close cousin of Shadow IT from the 2010s, but with potentially far worse consequences.
Why worse? Because when an employee pasted a file into an unapproved tool, the risk was mostly operational. When they paste confidential information into a public AI model, that content can:
- End up incorporated into the model’s training data
- Appear in responses to other users
- Be stored on servers outside your legal jurisdiction
- Violate GDPR, confidentiality agreements, or client clauses
And meanwhile, you have no idea what’s happening.
The two wrong reactions
When executives realize what’s going on, they usually react in one of two ways. Both are bad.
Reaction 1: "Ban everything"
Access to ChatGPT, Claude, Gemini, and the like is blocked from the corporate network. An email goes out saying AI use for work tasks is forbidden. Case closed.
Problem: your employees keep using it from their personal phones, from home, or from private accounts. Only now they’re doing it in secret, with no way for you to help them do it properly. On top of that, you lose all the competitive advantage that well-applied AI can give you.
Reaction 2: "Free for all"
"AI is the future, everyone should use it." No training, no guidance, no limits. "Let everyone experiment."
Problem: someone will eventually paste your biggest client’s contract into a free tool. Someone will use AI to make an important decision without checking the output. Someone will automate a critical process with a tool that stops working next week.
What a coherent AI policy really is
An AI policy is not a 40-page document written by legal that nobody reads. It’s a clear set of rules and principles that answer three basic questions:
- What do we want to use AI for in our company?
- Where are the boundaries?
- Who decides what gets implemented and how?
That’s it. If your policy answers these three questions clearly, you’re already ahead of 90% of companies.
The components of a sensible policy
Let’s get to the point. This is what your AI policy should include:
1. Data classification
Not all company data carries the same level of sensitivity. A coherent policy distinguishes between:
| Category | Examples | AI use |
|---|---|---|
| Public data | Marketing materials, blogs, website info | Free use |
| Internal data | Processes, templates, internal communications | Approved AI, with care |
| Confidential data | Client information, financials, strategy | Only on-premise or private AI |
| Regulated data | Personal data, health, finance | Specific restrictions depending on regulations |
2. Approved tools
Define which AI tools are allowed for which use cases. It doesn’t have to be a fixed list forever — it should be able to grow — but there should be a process for approving new tools before they are used.
3. Allowed and prohibited use cases
Be specific. "Use AI sensibly" is not a policy. This is:
✅ Allowed: drafting internal email messages, summarizing public meetings, generating campaign ideas, translating non-confidential content, analyzing public data.
⚠️ Allowed with supervision: generating code that will go to production, drafting customer communications, analyzing non-sensitive internal data.
❌ Prohibited: entering customer personal data into public tools, making automated decisions about people without human review, using AI to generate content without fact-checking.
4. Mandatory human oversight
Clearly define which processes require AI output to be reviewed by a human before it takes effect. This is one of the most important parts, and one of the most commonly ignored.
5. Accountability
Who is responsible when something goes wrong? The employee who used the tool? Their manager? IT? If it’s not clear, no one will be responsible and everyone will be responsible at the same time — which is the same thing.
6. Training
A policy without training is just paper. Your team needs to understand not only what they can and can’t do, but why. When people understand the risks, they make better decisions than when they’re just memorizing rules.
The mistake big consultancies make
Many companies hire a Big Four firm to write an AI policy for them. They receive a 60-page document packed with frameworks, governance committees, risk matrices, and process diagrams.
Nobody reads it. Nobody applies it. And six months later, they’re still in the same place as before — only now with a PDF sitting somewhere in SharePoint.
An AI policy that works has three qualities:
- It’s short. If it doesn’t fit in 5 pages, nobody will read it.
- It’s specific. "Use AI ethically" tells nobody anything. "Don’t paste contracts into free ChatGPT" does.
- It’s living. AI changes every week. Your policy should be reviewed quarterly, not every five years.
The link between policy and architecture
Here’s something many people overlook: your AI policy and your technical architecture are more connected than they seem.
If your policy says "customer data never leaves our systems," then you can’t rely on public OpenAI APIs to process that data. You need either open-source models running in controlled infrastructure, or very specific contractual agreements with your vendors.
If your policy says "every automated process must have human oversight at critical points," then you can’t build monolithic AI workflows without checkpoints. You need modular architectures where human intervention is built into the design.
This is precisely one of the reasons why at Studio SmartWork we build on open-source tools like n8n. When we design an AI workflow for a client, we can control exactly which data goes to which model, which steps require human approval, and where the logs are stored. You’re not tied to the decisions a SaaS provider makes about your information.
A starter template
If you don’t have anything yet, here’s a minimal structure you can use to get started today:
1. Purpose
Why our company is adopting AI and what we expect to achieve.
2. Scope
Who this policy applies to (all employees, contractors, etc.).
3. General principles
- Human oversight in important decisions
- Fact-checking before external use
- Protection of confidential data
- Transparency with clients when AI is used
4. Data classification
[Table with three or four levels]
5. Approved tools
[Updatable list]
6. Use cases
- Allowed without restrictions
- Allowed with supervision
- Prohibited
7. Responsibilities
Who approves, who oversees, who trains.
8. Review process
How often this policy is reviewed and how changes are proposed.
Customize it, trim it, and publish it. Seriously — an imperfect policy published today is worth infinitely more than a perfect policy that’s still a draft six months from now.
The real cost of having no policy
Let’s go back to the practical question: what happens if you still don’t have an AI policy?
In the short term, probably nothing visible. People will keep using the tools, things will keep working, and you’ll feel like you’re "being agile."
In the medium term, you’ll start noticing inconsistencies. Different departments using different tools. Outputs that can’t be replicated. Work that has to be redone because AI generated something it shouldn’t have. Decisions made with information nobody verified.
In the long term — and this is the scary part — you’ll discover a leak. Or a client will discover you generated their report with public AI without telling them. Or a regulator will come knocking asking about compliance. Or an employee will leave and you’ll realize half your critical processes depended on prompts only they knew.
The right question is not "if" but "how"
The AI conversation in your company is already happening, with or without you. The question is not whether your team will use artificial intelligence — they already are. The question is whether they’ll do it in a coordinated, safe, and profitable way, or in a chaotic, risky, and duplicated one.
A coherent policy is not a brake on innovation. It’s the opposite: it’s the framework that lets your team experiment with confidence, knowing where the lines are and what they can do without fear.
And when the time comes to implement real AI solutions in your business — not one-off toys, but systems that actually eliminate repetitive work — having a clear policy will make the process ten times faster. Because you’ll already know what data can go where, which processes can be automated, and what oversight you need to keep in place.
That’s the difference between a company that adopts AI with intention and one that adopts it by inertia. And six months later, that difference shows up in the results.