Practical AI

AI Use Policy & Governance

We find the AI tools your staff already use, decide with you which to approve, and write a short policy people can follow: what information can go into which tool, and who checks the result.

Discuss an AI Use Policy
The eagle finds the AI tools staff already use, approves one, blocks a browser extension, and publishes a policy that answers whether customer data can be pasted into a tool.

What we usually find.

Staff already use AI, often on personal accounts. A ban stops them telling you, not using it.

Discovery scanFictional 140-person firm

6 tools found · 1 approved

Pick a tool for detail

Free chat assistant (personal accounts)

Seen in
Proxy and DNS logs
Probably touched
Client emails, draft proposals and one pasted list of customer names
Where we look
  • Sign-in logs
  • Proxy and DNS
  • Browser extensions
  • Expense claims
  • Staff survey

Illustrative: the tools and numbers are invented.

“Can I use AI for this?”

The question staff actually ask. Pick the information and the tool.

What information is it?
Which tool?

Can I put internal information into the company-approved assistant?

Yes

The approved assistant keeps your work in the company account and does not train on it.

What to doGo ahead, and check the result before it is used.

A sample. Your answers depend on the tools you approve.

What the policy covers.

Five short sections in your staff’s words. Open one to read the sample wording.

AI Use Policy

Version 1.0 · Two pages · Next review March 2027

  1. Which tools you can use

    Use the tools on the approved list, signed in with your work account. Want something new? Ask IT what it is and what it is for. You will get an answer within five working days, and a yes goes on the list for everyone.

    Why it’s therePeople work around rules that have no route to yes.

  2. What information can go where

    Public information can go into any tool. Internal information and customer data go only into approved tools, and only as much as the task needs. Passwords, keys and tokens never go into any AI tool.

    Why it’s thereOne grid answers most questions, so nobody has to guess.

  3. You check it, you own it

    AI can draft, summarise and suggest. A person checks the result before it is sent, published or relied on, and is accountable for it as if they had written it.

    Why it’s thereA tool cannot answer for a wrong figure in a client report. Someone has to.

  4. Connecting AI to other systems

    Use only the extensions and meeting bots on the approved list. Connecting any other AI tool to email, files or calendars needs IT to agree first.

    Why it’s thereA connection hands the tool your access, not just your question.

  5. If something goes wrong

    If something has gone into a tool that should not have, tell IT or the data protection lead the same day. You will not be in trouble for reporting it.

    Why it’s thereMistakes reported early are quick to fix. Hidden ones are not.

How it runs.

Discovery is quick because the records already exist.

  1. Discover

    Logs, extensions, expenses and a no-blame survey. Teams, not names.

  2. Decide with you

    Approve, limit, replace or block, one tool at a time.

  3. Write

    A two-page policy, the register and a staff one-pager.

  4. Brief staff

    A short session per team. Pairs with Practical AI Training.

  5. Review

    Every six months, or when a tool changes its terms.

    Then back to discover

What you receive.

What managers need to answer questions, and staff need to stop asking them.

  • Findings
  • Register
  • Policy
  • Staff one-pager
  • Review date
Approved-tools registerSample, illustrative
  • 1 approved
  • 2 with limits
  • 2 replaced
  • 2 blocked
ToolDecision
Company-licensed assistantApproved
Coding assistantApproved with limits
Free chat assistant (personal accounts)Replaced
Browser writing extensionBlocked
Next review: March 2027

Why have a security team do this?

“We don’t know what people are pasting into these tools.”

Spotting unapproved software in sign-in, proxy and DNS logs is routine security work.

How we do it

We know where pasted data goes, so we close the risky routes and keep the useful ones open.

  • Data questions firstWhat could leak is settled before switch-on.
  • Access set up properlyWe configure and test it ourselves.
  • Verified with your peopleSessions in plain English, not slide decks.

Related Practical AI services

All Practical AI services
Not sure what is in use?

Start with discovery. Your logs already know more than you think.

Discuss an AI Use Policy