Your Company AI Policy Explained: Three Rules That Matter
Approved tool, no client data, verify before it leaves. What your company AI policy actually requires of you, and what to do when it does not cover your situation.
A company AI policy is usually three things: which tools you may use, what you may put into them, and what you must check before the output goes anywhere. If you remember only one line, make it this: approved tool, no client data, verify before it leaves.
Three Questions Every Policy Answers
Policies differ in length and tone. Underneath, a company AI policy is answering the same three questions.
- Which tools may you use?
- What may you put into them?
- What must you check before the output leaves?
If you can answer those three for your own job, you have understood the document, whatever it is called.
Rule 1: Approved Tool
Most policies name a short list. That usually reads like gatekeeping. It is not.
An approved tool is one where somebody has read the contract, checked whether it trains on your content, and confirmed where the data is stored. That is genuinely all the word approved means.
Which is also why a new tool is not forbidden; it is just not checked yet. Ask and it often gets added. The answer is usually yes.
The free version of an approved tool is often not the approved tool. The contract sits on the business account. Signing in with a personal address on the same website puts you outside it, using the same interface. Check the sign-in address.
Rule 2: No Client Data
This is the rule people find hardest, because the line between company information and client information is blurrier in practice than on paper.
When you cannot tell which it is, treat it as client information. That instinct is right far more often than it is wrong, and the cost of being cautious is a slightly worse prompt.
Also worth knowing: identifiers hide in places people do not check. File paths, error messages, screenshots and document properties all carry names. Stripping the obvious name from the sentence is not the same as removing the client from the paste. See what you can paste into ChatGPT.
Rule 3: Verify Before It Leaves
Anything with a name, a number, a date or a citation gets checked by a person before it goes anywhere.
That is not a comment on any particular tool. It is that these systems produce fluent text regardless of accuracy, so the check has to come from outside. Our guide on how to tell when an AI answer is wrong has the thirty second version.
If you remember one line from your company AI policy, make it this one.
Approved tool. No client data. Verify before it leaves.
Nine words. They cover the large majority of real situations you will meet.
When The Policy Does Not Cover Your Situation
It will happen. Policies are written before the situations arrive.
Ask before, not after. A question beforehand is a two minute message. The same question afterwards is an incident report, and the facts are worse by then. Nobody has ever been in trouble here for asking first.
What A Policy Is Not
A company AI policy is not a ban, and it is not there to slow you down. Most of them exist because someone wanted staff to be able to use these tools confidently rather than quietly.
Quiet use is the actual risk. People who think the answer might be no tend to use personal accounts on personal devices, which is the worst version of every problem in this category.
If Your Company Does Not Have One Yet
Quite a few do not, and that is not unusual this year. If that is your situation, the useful thing you can do is mention it to whoever owns the decision.
We keep a practical guide for owners and partners covering exposure, obligations and a usable policy template, at AI guardrails for attorneys. It is written for the person who has to sign the policy, not for the person following it. At the company level, the same questions are addressed by frameworks like the NIST AI Risk Management Framework.
Common Questions
What if my company AI policy contradicts what a client asked for?
The stricter one wins, and you should flag the conflict rather than pick. That is a decision for someone with the authority to make it.
Does the policy apply on my own laptop?
If you are doing company work, yes. Policies follow the work, not the hardware.
Can I use AI for personal things on my work account?
Check your acceptable use policy. Usually light personal use is fine, and the same data rules still apply because it is still the company account.
Who do I ask when I am not sure?
Your manager for whether you may, and our help desk for whether it is safe. Those are two different questions and they have two different answers.
How often should a company AI policy be reviewed?
More often than most other policies. Vendor defaults changed materially in 2025, as covered in AI training on your data. Twice a year is reasonable.
Policy Unclear? Ask Before You Paste.
If your company AI policy does not cover what you are about to do, ask us first. We also help businesses write an AI acceptable use policy their staff can actually follow.