AI Governance for Leaders: How to Write a Simple AI Use Policy

AI governance is how your organization decides who uses AI, with what data, checked by whom, and accountable to whom. Writing an AI use policy means putting those decisions into one or two pages of plain language: name the approved tools, the data that's off limits, a human-checks-it-first rule, when to disclose AI's involvement, and who owns the calls. Short, clear, and built to be followed.

So here's the conversation I keep having with leaders. They ask me whether they need an AI policy, and somewhere in their head is a picture of a forty page legal document with a lawyer's name on it. Then I ask them a simpler question. How many people on your team used an AI tool this week? They usually don't know. And that's the whole point. The tools are already in the building. Governance is just the question of whether anyone has set the rules for them yet.

I work with executives and mission-driven leaders on putting AI to practical use, and this is one of the first things I help them sort out, because it's the difference between a team that uses AI with some basic guardrails and a team where everyone's making their own call about what's okay with nobody watching. Let me walk you through what governance actually means and how to write the policy this week.

What AI governance actually means (and why it isn't just a legal document)

Let me define the term first, because it gets thrown around a lot. AI governance is the set of rules and habits that decide how your organization uses AI. Which tools are okay. What information your people can put into them. How the output gets checked. Who's responsible when a tool gets something wrong. That's it. It's the operating instructions for AI inside your walls.

The reason I push back on the legal-document picture is that the document is the smallest part. Think about driving. The traffic laws matter, but the thing that actually keeps you alive on the road is the thousand small habits you've built: checking your mirror, slowing into a curve, leaving space. Governance works the same way. The policy is the written law. The real work is the habits your team runs on every day when there's no lawyer in the room.

So when a leader tells me they "need a policy," what they usually need is two things. A short written rule set people can point to, and a set of habits the leadership actually models. The document without the habits is theater. The habits without the document fall apart the moment a new hire shows up and has to guess.

Why most teams already use AI with no rules (the shadow-AI problem)

Here's the thing almost every leader underestimates. Your team didn't wait for permission. People found these tools on their own, on their personal logins, on their phones, and started pasting work into them because it made their day easier. There's a name for this now. People call it shadow AI, meaning AI use that's happening inside your organization without anyone approving it or even knowing about it.

And honestly, I get why it happens. Someone has a report due, an AI tool drafts it in two minutes, and the alternative is staying late. Nobody's being reckless. They're being human. The problem is that without any rules, that same well-meaning person might paste a client's private information, or a draft contract, or a list of donor names into a tool with no idea where that data goes or who can see it.

Banning it doesn't work, by the way, because you can't ban something you can't see, and people will just use it more carefully hidden. The move that works is to bring it into the light. Give people approved tools and clear rules, so the easy path and the safe path are the same path. That's what a policy is really for. It's permission with guardrails, not a wall.

The principles a good policy protects

Before you write a single rule, it helps to know what you're actually trying to protect. A good policy isn't a random list of dos and don'ts. It's built to defend a handful of things that matter, and once you see them, the rules write themselves. Here's what every AI use policy I help build is designed to protect.

• Data security — keeping confidential information out of tools that might store it, train on it, or expose it. This is the one that bites small organizations hardest.
• Privacy — protecting the personal information of your clients, your donors, your patients, and your own people from ending up somewhere it shouldn't.
• Accuracy and verification — making sure a human checks anything important before it goes out, because AI tools confidently produce wrong answers and won't tell you when they have.
• Transparency — being honest about when AI was involved, so your clients, your board, and your team aren't misled about who or what did the work.
• Human accountability — keeping a named person responsible for every decision, so "the AI did it" never becomes an acceptable answer.

Notice that none of these is about the technology. They're about trust. Trust with your clients, trust with your team, trust with the people you serve. When I sit with a leadership team and we work through these five, the policy stops feeling like compliance and starts feeling like a way to protect the thing the whole organization runs on.

A simple AI use policy you can write this week

You don't need a consultant or a legal team to get the first version on paper. You need an afternoon and the willingness to keep it short. The best AI use policy for a company that's just starting is one or two pages that a new hire can read on their first day and a busy manager can actually remember. Aim for plain language a teenager could follow, because a policy people don't understand is a policy people don't use.

Here's the checklist I give leaders for what an AI use policy should cover. Walk through each one and write a sentence or two on each.

• Approved tools — name the specific AI tools people are allowed to use for work, and a path for requesting a new one. A short approved list beats a vague "be careful."
• Data that's off limits — spell out plainly what people must never paste into an AI tool: client records, donor or patient data, passwords, contracts, anything confidential. Give examples, not abstractions.
• The human-checks-it rule — require that a person reviews and verifies anything important before it goes to a client, the public, or leadership. AI drafts; a human signs off.
• Disclosure — say when people should tell others that AI helped produce something, especially client-facing work, published content, or anything where the audience would want to know.
• Accountability — name who owns AI decisions, who people ask when they're unsure, and the principle that a human is always responsible for the output, never the tool.
• What to do when it's wrong — give a simple path for reporting a mistake, a data slip, or a tool behaving strangely, so problems surface fast instead of getting hidden.

That's the whole thing. Six sections, a few sentences each. If you find yourself writing a third page, you're probably writing for a lawyer instead of your team. In a larger or higher-risk organization, the rules behind these decisions get more involved, and that ongoing ownership is one of the things a fractional Chief AI Officer carries for a leadership team, though most organizations can write a solid first version themselves before they ever need that.

How to roll it out so people actually follow it

A policy nobody follows is worse than no policy, because it gives you the false comfort of thinking you've handled the risk. So the rollout matters as much as the writing. The mistake I see most often is a leader emailing a PDF to the whole team with the subject line "Please review," and then wondering six months later why nobody knows the rules.

Think about how a good onboarding works. You don't hand a new hire a manual and walk away. You sit with them, you show them how things run, you make it clear that questions are welcome. Roll out your AI policy the same way. Walk the team through it in a real conversation, explain why each rule exists, and tell them which tools they're cleared to use so the policy reads as permission and not just prohibition.

And make it safe to ask. The fastest way to kill a policy is to make people feel like asking "is this allowed?" is admitting they did something wrong. When someone on your team checks before they paste sensitive data into a tool, that's exactly the behavior you want, so treat it that way. A team that asks freely is a team where the rules are actually working.

One more thing. Plan to revisit it. The tools change fast, and a rule that made sense six months ago might be out of date now. Put a date on the policy and a reminder to look at it again in a few months. That single habit keeps governance alive instead of letting it become a document everyone forgot.

I think about this the way I think about almost everything in AI right now, including for my own kids. The goal was never to control the tool. It's to stay deliberate while the tool gets more powerful, so the people using it keep their judgment and the people you serve keep their trust. A simple policy, rolled out like you actually mean it, is how a leader does that.

Frequently Asked Questions

What is AI governance?

AI governance is the set of rules and habits that decide how your organization uses AI: what tools people can use, what data they can put into them, how they check the output, and who's accountable when something goes wrong. It isn't only a legal document. Most of governance is the everyday decisions your team makes when nobody's watching, and a good AI use policy makes those decisions easier instead of slower.

What should an AI use policy include?

A simple AI use policy should cover which tools are approved, what data is allowed in and what's off limits, a rule that a human verifies anything important before it goes out, when to tell people that AI helped produce something, who owns AI decisions, and what to do when a tool gets something wrong. Keep it to one or two pages in plain language so people actually read it and remember it.

Does a small company need an AI policy?

Yes, and usually more than a big one. Your people are already using AI tools whether you've blessed it or not, and a small team has less room to absorb a mistake like a client's private data ending up in the wrong place. A small company doesn't need a long legal framework. It needs a one page set of clear rules that protects your data, your clients, and your team's judgment.

How do I get employees to follow an AI policy?

Make it short, make it useful, and make it safe to ask questions. People follow a policy they understand and ignore one they can't find. Give them approved tools so the rule isn't just a ban, walk through it together instead of emailing a PDF, and make it clear that asking whether something is allowed is welcome, not a confession. A policy followed at eighty percent beats a perfect one nobody opens.