acceptable use policy

In depth

Five questions

A useful document fits on one page and answers five questions. Which tools are approved, by name, and through what channel to request them. Which categories of data may be put into them, which presupposes a prior classification, however rough, between public, internal, confidential and personal. Which tasks are encouraged, and which require human review before circulation. What is formally excluded, in a few lines. And who answers questions, with a name, not a generic mailbox.

Not risks alone

The main flaw of the policies that get written is to speak only of risks. A text that lists prohibitions without giving permitted uses obtains the opposite of what it seeks: employees go on using these tools, but on their personal accounts and without saying so, which moves the risk out of all visibility. An effective policy therefore names explicitly what is encouraged, and as early as possible, because practices settle in within a few weeks and take several months to correct.

Enforcement

There remains the question of enforcement, where most arrangements fail. A policy that rests only on goodwill does not hold: it takes at the very least a path simpler than the workaround, meaning an approved tool, reachable without a heavy procedure, and at least as good as the one people would use otherwise. The rule is worth remembering: shadow AI is not reduced by watching more closely, it is reduced by making the official route more convenient than the parallel one.