Every Company Needs an AI Use Policy

Nearly every business is using artificial intelligence (AI). Few are taking the steps necessary to govern it effectively. Four years after ChatGPT’s public launch, most companies still lack a robust policy governing the acceptable use of generative AI. Undaunted by this gap, many plan to deploy powerful AI agents across their organizations in the coming years. AI adoption is compounding; AI governance is not.

The technology’s rapid rise is responsible for this dynamic. AI has achieved mass adoption faster than the internet or the personal computer, with more than half of US adults now using it to some extent. Enterprises are embracing the technology even more rapidly. Four in five organizations are deploying generative AI in at least one business function, research by McKinsey shows.

Many of the companies that hurried to adopt AI have been slower to establish guardrails to manage its risks. Just 38% of enterprises have instituted comprehensive policies defining acceptable AI use, research by ISACA shows. Without them, how best to balance AI’s risks and benefits is left up to individual employees’ judgment — and they are not always making the right call. Uploading proprietary company information to a public AI tool or using such a tool to generate code or other intellectual property for a company has become an all-too-common occurrence.

Potentially troublesome AI usage is not limited to rank-and-file employees. Like the population at large, directors of public companies are enthusiastic adopters of AI tools, with 82% of them saying they have used AI for board work, according to research by Diligent. When they are doing so with public AI tools, it could raise serious corporate governance issues. If discussions that normally would be protected by attorney-client privilege are captured by AI systems, a court may determine that privilege has been waived, for example. Most directors are navigating these emerging risks without the benefit of formal processes governing board AI use. Only 6% of companies have implemented such a policy.

Time to address these gaps is short. Another wave of enterprise AI adoption is coming. Agentic AI adoption is still in its earliest stages across most corporate functions, per McKinsey data, but that is about to change. According to Deloitte’s 2026 State of AI study, 74% of organizations plan to deploy AI agents within the next two years. Just 21% have a mature governance model for them.

The Uncertain Landscape

Implementing a strong policy governing acceptable AI use has long been a best practice, albeit one that relatively few companies truly embraced. It is now a business imperative. A powerful convergence of external factors should prompt executives and boards to take this crucial step if they have not already done so.

First, the rapidly evolving global regulatory landscape requires it. New transparency requirements under the European Union’s AI Act are now in force, with additional requirements for companies deploying systems deemed high-risk deferred until December 2027 and August 2028. In the United States, state legislatures are moving ahead with bills targeting training-data transparency, oversight of automated decision-making, and frontier-model safety requirements, among other areas of focus. These efforts continue even amid the Trump administration’s attempt to preempt state policymaking via executive order. In total, the Organisation for Economic Co-operation and Development now tracks more than 2,000 AI policy initiatives across 80-plus jurisdictions. Against this backdrop, it is clear that what is permissible in one place may be proscribed in another. A company’s AI policy is the connective tissue that keeps a multi-jurisdiction compliance posture coherent.

Second, demand for coverage against AI-related risks may soon reprice directors and officers (D&O) and cyber insurance renewals. In a survey of 600 global companies by the Geneva Association, an insurance industry trade group, 90% of respondents said they would value such coverage and two-thirds said they would be willing to pay at least 10% more to obtain it. As this demand continues to grow, companies with robust AI governance may have an edge in the marketplace over less-proactive peers.

Finally, the evidence suggests governance and innovation move together rather than against each other. Organizations with comprehensive AI governance policies are nearly twice as likely to be early adopters of agentic AI as those with partial guidelines and are almost four times as likely as those with policies still in development, research by the Cloud Security Alliance shows. Ungoverned initiatives are much more prone to stall in pilots, security reviews, and internal disputes. In survey after survey, executives report that their organizations still struggle to realize cost or revenue benefit from AI. The missing ROI could be hiding in the governance layer.

A Foundation to Build On

To navigate these crosscurrents, companies should pursue a three-part AI governance agenda that lays out how the technology can be used safely and who has ultimate responsibility for managing risks. These are foundational steps on which further policies and systems can be built. Steps to consider include:

• Adopt an enterprise AI acceptable use policy. Every company needs a customized policy that defines approved and prohibited tools; rules for confidential, proprietary, and personal data, as well as the development and protection of intellectual property; procurement and vendor-diligence requirements (training rights, retention, and zero-data-retention configurations); human-review requirements for AI output; and clear consequences. This applies whether a company is building AI systems, deploying them as part of its customer offerings, or simply using them for internal purposes. The acceptable use policy provides a framework within which all of a company’s AI tools can operate safely. It is the single highest-leverage document in AI governance.
• Implement a board-specific AI use policy. Directors’ own use of AI raises distinct issues, including the confidentiality of board materials, attorney-client privilege and work-product waiver, an expanded and text-searchable corporate record, and deliberative candor. A board policy should address approved enterprise-grade tools, prohibited consumer tools, rules for privileged material, protocols for recordings and AI-generated minutes, and retention with legal-hold overrides.
• Formalize board oversight of AI governance. Boards should assign AI oversight to the full board or a designated committee, put management’s AI governance program on a regular reporting cadence (adoption metrics, incidents, shadow-AI findings, and regulatory developments), build director AI literacy, and confirm that D&O coverage reaches AI-related claims.

From MVP to MVG

An important milestone in software development is the minimum viable product, or MVP. This is the lightest-weight version of an offering that will satisfy early adopters and prove out the business case necessary to justify additional investment. For companies in all industries, an acceptable use policy, a board AI policy, and structured board oversight represent minimum viable governance for 2027. They provide the rules that let leaders embrace innovation with confidence and prepare their organizations for what is next.