Developing an AI Use Policy: Balancing Innovation, Opportunity and Risk

🧭 Dojo Compass

Module: Finance, Risk Management and Long-Term Resilience

Focus Area: Technology, AI and Future Readiness

Artificial intelligence is rapidly changing how businesses operate. From research, communications and software development to customer service, financial analysis and operational management, AI can help companies improve productivity, reduce costs, develop new capabilities and create new sources of value.

But adopting AI also introduces new risks. These can include the disclosure of confidential information, inaccurate or misleading outputs, intellectual property issues, cybersecurity vulnerabilities, regulatory exposure and excessive reliance on automated systems.

For companies, the challenge is not simply deciding whether to use AI. It is determining how to use it effectively and responsibly.

This article introduces a framework for developing an AI Use Policy. Rather than prescribing a universal template, it identifies the principal issues companies should consider and the practices that can help them establish a policy suited to their particular circumstances.

The objective is to create a coherent, flexible and continuously updated framework that enables a company to navigate the rapidly changing AI environment while using AI to strengthen its competitive position and build value.

🎯 Key Challenge

AI adoption is often happening faster than the development of internal policies, procedures and organizational capabilities.

Employees may already be using publicly available AI tools to prepare documents, conduct research, analyze information, write code, communicate with customers or automate routine activities.

In many cases, these activities begin informally. An employee discovers a useful tool, experiments with it and begins incorporating it into their daily work. Other employees follow, and before long, AI has become part of the company’s operations without any coordinated decision about how it should be used.

This creates several challenges.

1. The company may not know how AI is actually being used.

Employees may be using different tools for different purposes, sometimes without management knowing which applications are involved or what information is being submitted to them.

This makes it difficult to assess the company’s overall exposure or identify opportunities for more systematic adoption.

2. The risks are not the same for every AI application.

Using AI to improve the wording of an internal presentation is fundamentally different from using it to evaluate a loan application, generate production software, provide legal advice or make decisions affecting employees.

The nature and significance of the risks depend on the application, the information involved, the degree of human oversight and the consequences of an incorrect output.

3. Employees may not understand the limitations of AI.

AI systems can produce inaccurate information, invent references, overlook important context or present uncertain conclusions with considerable confidence.

Employees who do not understand these limitations may rely on AI-generated outputs without applying appropriate judgment or verification.

4. Excessively restrictive policies can prevent valuable innovation.

Some companies respond to AI-related risks by prohibiting its use or imposing broad restrictions.

Although this may reduce certain immediate exposures, it can also discourage experimentation, limit productivity improvements and place the company at a disadvantage relative to competitors that are adopting AI more effectively.

5. Policies can quickly become outdated.

AI capabilities, business applications and regulatory requirements are changing rapidly. A policy that is appropriate today may not adequately address new technologies, emerging risks or changes in the legal environment a year from now.

The challenge is therefore to establish a policy that provides sufficient direction and control without becoming an obstacle to innovation.

🥋 Dojo Solution

Treat an AI Use Policy as a management framework, not simply a list of restrictions

A well-designed AI Use Policy should establish the principles, responsibilities and procedures that guide the company’s adoption and use of AI.

It should answer five fundamental questions:

1. Where can AI create value? Identify opportunities to improve business activities, products, services and decision-making.
2. What risks does AI introduce? Understand the potential consequences of using AI in different business contexts.
3. Who has authority to approve AI use? Establish clear responsibilities and approval procedures.
4. How will employees use AI effectively? Provide education, guidance and access to reliable information.
5. How will the policy evolve? Create a process for reviewing and updating the policy as experience, technology and regulation change.

The appropriate policy will vary considerably depending on the company’s size, industry, regulatory environment, information sensitivity and existing technology infrastructure.

A small professional services firm may need relatively simple rules governing confidential information, research and document preparation. A software company may need more detailed provisions addressing source code, intellectual property, software licensing, security and AI-generated code. A financial institution may require more extensive controls around automated decision-making, customer information and regulatory compliance.

There is no single policy that will be appropriate for every company.

However, there is a common framework that can help businesses develop policies suited to their circumstances.

🏗️ Putting It into Practice

Step 1: Analyze AI use and related risks

The first step should be understanding how AI is currently being used and where it could create additional value.

Companies should avoid beginning with an abstract discussion of AI risks. Instead, they should examine their actual business activities and identify practical applications.

This can be done by reviewing the principal functions of the company, including:

• Sales, marketing and customer relationships.
• Finance, accounting and administration.
• Human resources and recruitment.
• Research, product development and innovation.
• Software development and information technology.
• Operations, logistics and supply chain management.
• Legal, compliance and risk management.

For each function, consider whether AI could improve productivity, quality, speed, cost efficiency or decision-making.

At the same time, identify the risks associated with each potential application.

A useful starting point is to distinguish between four broad categories:

A. Information and confidentiality risks

• Could employees submit confidential business information to an external AI service?
• Could customer, employee or commercially sensitive information be exposed?
• Does the AI provider retain submitted information or use it to improve its models?
• Are there restrictions on transferring information across jurisdictions?

B. Accuracy and decision-making risks

• Could AI produce inaccurate or misleading information?
• Would an incorrect output have material financial, operational or reputational consequences?
• Is human review required before the output is used?
• Can the company independently verify the results?

C. Legal and intellectual property risks

• Could AI-generated material infringe third-party intellectual property rights?
• Are there licensing restrictions on AI-generated code or other content?
• Does the company have the necessary rights to submit the information it provides to an AI system?
• Are there regulatory requirements governing the particular AI application?

D. Operational and security risks

• Could an AI system introduce vulnerabilities into company systems?
• Does the application have access to sensitive internal databases or software repositories?
• Could automated actions produce unintended consequences?
• Is there sufficient control over the system’s permissions and activities?

The objective is not to create an exhaustive list of every theoretical risk. It is to identify the risks that are material to the company’s actual and intended AI use.

Introduce a risk-based classification

A practical approach is to classify AI applications according to their potential impact.

Risk category	Typical applications	General policy approach
Low	Improving wording, summarizing non-confidential information, generating routine ideas	Generally permitted within basic guidelines
Moderate	Internal research, business analysis, preparing customer materials, assisting with code development	Approved tools, appropriate verification and defined safeguards
High	Processing sensitive information, material financial analysis, legal or HR support, production code generation	Specific approval, enhanced controls and documented human oversight
Restricted	Applications involving prohibited or unacceptable uses, or uses that cannot meet legal, security or company requirements	Prohibited unless the relevant legal and organizational barriers can be resolved

These categories should be adapted to the company and its regulatory environment. They are not a substitute for determining whether a particular use is legally prohibited or subject to specific regulatory requirements.

Importantly, the classification should consider both the AI tool and the particular way it is being used. A tool that is appropriate for one purpose may be inappropriate for another.

Step 2: Establish policy approval and governance

An AI Use Policy should have clear organizational authority.

It should not be treated as an informal set of suggestions circulated by the IT department or an individual employee. It should be approved through the company’s appropriate governance structure.

Depending on the company’s size and organizational documents, this may involve the Board of Directors, senior management or another authorized governance body.

The Board’s role should generally be to:

• Approve the company’s overall approach to AI adoption and risk management.
• Ensure that AI-related risks are incorporated into the company’s broader risk management framework.
• Establish appropriate management accountability.
• Oversee significant AI-related investments and material applications.
• Receive periodic reports on AI adoption, material incidents and policy effectiveness.

Management should generally be responsible for developing and implementing the policy, including establishing procedures, selecting tools, allocating resources and monitoring compliance.

A company may also establish an AI working group or designate an AI policy owner. This need not be a new department. In smaller organizations, responsibility may be assigned to an existing executive or management team.

The important thing is that responsibilities are clearly defined.

Establish an approval process for AI applications

Not every use of AI requires formal management approval. Requiring employees to obtain permission before using AI for every minor task would create unnecessary bureaucracy.

Instead, the policy should establish approval requirements based on the nature and risk of the proposed application.

For example:

• Low-risk applications may be used without individual approval, provided employees follow established guidelines.
• Moderate-risk applications may require the use of an approved tool and compliance with specific procedures.
• High-risk applications should require documented assessment and approval by the appropriate management function.
• Applications involving material legal, regulatory, security or reputational exposure may require legal, compliance, cybersecurity or Board-level review, as appropriate.

The approval process should consider:

1. The business purpose and expected benefits.
2. The type of information the AI system will process.
3. The identity and reliability of the provider.
4. Data retention, confidentiality and security arrangements.
5. Intellectual property and contractual implications.
6. The potential consequences of inaccurate outputs.
7. Human oversight and accountability.
8. The ability to monitor, suspend or discontinue the application.

The company should also distinguish between approving an AI tool and approving a particular use of that tool. Approval to use a particular AI platform should not automatically authorize every possible application of that platform.

Step 3: Establish practical rules for employees

A policy should translate the company’s risk assessment into clear and understandable instructions.

Employees should be able to determine what they can do, what they should avoid and when they need to seek guidance.

Some general principles may include:

Use approved tools. Employees should use AI services that have been assessed and authorized for the relevant category of information and activity.

Protect confidential information. Employees should not submit confidential business information, customer data, personal information or other restricted material to AI systems unless the particular use has been authorized and appropriate safeguards are in place.

Verify important outputs. AI-generated information should not automatically be treated as accurate. Employees remain responsible for checking facts, calculations, references, analysis and other material outputs before relying on them.

Maintain human accountability. AI should support appropriate human judgment rather than remove accountability from the individuals responsible for business decisions.

Respect intellectual property rights. Employees should consider whether they have the right to submit source materials to an AI system and whether the resulting output can be used for the intended commercial purpose.

Report problems. Employees should know how to report suspected data disclosures, security incidents, inaccurate outputs, unauthorized uses or other AI-related concerns.

The policy should also address the use of AI agents and automated workflows where relevant. These systems can do more than generate information: they may interact with applications, access databases, send communications or execute transactions.

The degree of control should reflect the actions an AI system can perform. For example, an AI tool that drafts an email for employee review presents a different risk from an agent authorized to send emails, modify customer records or initiate financial transactions without prior approval.

Step 4: Invest in AI education and information updating

An AI Use Policy is only effective if employees understand it and have sufficient knowledge to apply it.

This is particularly important because AI systems are often easy to use, while their limitations and associated risks may be less apparent.

Companies should establish an ongoing AI education program that addresses both the opportunities and the risks.

Education should cover several areas:

A. Understanding AI capabilities and limitations

Employees should understand, at a practical level, how AI systems operate, what they are good at and where they are unreliable.

This should include the possibility of inaccurate outputs, fabricated references, incomplete information and other limitations.

B. Effective AI use

Employees should learn how to formulate useful requests, provide appropriate context, assess outputs and incorporate AI into their work processes.

The objective should be to improve the quality of work, not simply to increase the volume of AI-generated content.

C. Company policy and responsibilities

Employees should understand which tools are approved, what information can be submitted, when additional authorization is required and who is responsible for the results.

D. Function-specific applications

Different departments will have different opportunities and risks. Training should therefore include practical examples relevant to each function.

For example, software developers may require guidance on code generation, software licensing and repository security, while finance employees may need guidance on the verification of calculations, financial analysis and confidential information.

Create an AI information-sharing process

AI education should not be limited to an initial training session.

Companies should establish a way to keep employees informed about relevant developments, including:

• New AI tools and capabilities.
• Changes to approved platforms and their terms of service.
• Emerging security and privacy concerns.
• Relevant regulatory developments.
• Internal experiences and successful applications.
• Lessons learned from errors or incidents.

This could be accomplished through periodic internal updates, short training sessions, an internal knowledge repository or an AI working group.

The important point is to create a process through which relevant information reaches the people who need it.

Step 5: Monitor AI use and evaluate results

A company should not assume that an AI policy is effective simply because it has been approved and distributed.

It should monitor both the risks and the business value associated with AI adoption.

Risk monitoring might include:

• Unauthorized use of AI tools.
• Accidental disclosure of confidential information.
• Security incidents and vulnerabilities.
• Materially inaccurate AI-generated outputs.
• Intellectual property or licensing concerns.
• Complaints or regulatory issues.

Value monitoring should be equally important.

For example, companies may examine:

• Time saved in particular business activities.
• Reductions in operating costs.
• Improvements in productivity or output quality.
• Faster delivery of products or services.
• Improved customer experience.
• New products, services or commercial opportunities.
• Improvements in decision-making and internal processes.

The company should also consider whether AI adoption is producing sustainable improvements or simply shifting work from one activity to another.

For instance, generating a report more quickly may not create meaningful value if employees then spend excessive time correcting inaccuracies.

The ultimate objective is to understand whether AI is actually improving the company’s performance.

Step 6: Update the policy as technology, experience and regulation evolve

AI policies should not be treated as permanent documents.

New AI capabilities can create opportunities that did not previously exist, while also introducing risks that were not contemplated when the original policy was approved.

Similarly, changes in laws, regulations, contractual requirements and industry standards may require companies to modify their policies and procedures.

A company should therefore establish a formal review process.

A useful approach is to combine:

Periodic reviews

Conduct a scheduled review at least annually, or more frequently where the company’s activities or regulatory environment warrant it.

Event-driven reviews

Review the policy when significant developments occur, such as:

• The introduction of a new category of AI application.
• A major change in the capabilities of an approved AI platform.
• A significant security or confidentiality incident.
• A material change in the company’s business activities.
• New legal or regulatory requirements.
• Evidence that existing procedures are ineffective or unnecessarily restrictive.

Experience-based improvements

Use feedback from employees, management and other stakeholders to identify practical problems.

For example, employees may find that approval procedures are too cumbersome, that certain restrictions prevent legitimate business applications or that existing guidance does not address a new type of AI workflow.

These observations should inform policy improvements.

Maintain a record of policy development

Companies should retain a record of material policy changes, including:

• The date and version of the policy.
• The reason for the change.
• The person or function responsible.
• The relevant approval.
• Any new employee guidance or training required.

This provides a useful history of how the company’s approach to AI has evolved and helps ensure that employees are working from the current policy.

Step 7: Build flexibility into the policy itself

One final consideration is particularly important: avoid making the policy excessively dependent on specific AI products or technologies.

AI systems change quickly. A policy that is written around the detailed features of one particular tool may become obsolete when that tool is updated or replaced.

It is generally better to establish durable principles and control requirements, supported by more easily updated operational guidance.

For example:

• The main policy can establish principles governing confidentiality, accountability, human oversight, approved use and risk management.
• An approved-tools register can identify the platforms employees may use.
• Departmental procedures can address particular applications, such as software development or financial analysis.
• Training materials can provide practical examples and instructions.
• Technical standards can establish requirements for access, security, data handling and system integration.

This structure allows the company to update individual procedures without having to rewrite and formally reapprove the entire policy every time an AI tool changes.

The policy should be sufficiently clear to establish meaningful controls, but sufficiently flexible to accommodate new opportunities and developments.

📌 Key Takeaways

• AI adoption should be treated as a business management issue, not simply an IT matter.
• A good AI Use Policy should enable innovation while managing material risks.
• Companies should begin by understanding how AI is being used and identifying where it can create additional value.
• AI applications should be evaluated according to their purpose, the information involved and the potential consequences of their use.
• Approval responsibilities should be clearly established, with controls proportionate to the risks.
• Employees need practical guidance on confidentiality, accuracy, intellectual property, security and human accountability.
• AI education and information-sharing should be ongoing activities, not one-time exercises.
• Companies should monitor both AI-related risks and the business benefits resulting from adoption.
• Policies should be reviewed periodically and whenever significant developments make existing provisions inadequate.
• A flexible policy structure can help companies respond to changing technology without creating unnecessary administrative burdens.

🌿 Reflection

AI presents companies with an unusual management challenge.

The technology is developing rapidly, its potential applications are expanding and the associated risks are not always immediately apparent. Waiting until every issue is fully understood before adopting AI is unlikely to be a competitive strategy. Equally, allowing unrestricted adoption without considering the consequences can expose a company to unnecessary risks.

The answer lies in developing an organizational framework that enables informed experimentation and responsible adoption.

A good AI Use Policy should not be viewed as a document designed primarily to prevent employees from making mistakes. It should be an instrument that helps the company identify opportunities, establish appropriate boundaries, develop internal capabilities and learn from experience.

It should also recognize that AI adoption is not simply about giving employees access to new tools. The greatest value may come from redesigning workflows, connecting information, improving collaboration and developing entirely new ways of delivering products and services.

This leads to an important question:

Is your company developing a coherent approach to AI adoption, or is it simply allowing employees to experiment with individual tools without an overall strategy?

The difference may have a significant effect on the value the company ultimately derives from AI.

⚔️ Dojo Mission

Conduct a preliminary review of your company’s AI use.

Identify:

1. Which AI tools employees are currently using.
2. The principal business activities in which AI is being applied.
3. Three opportunities where AI could create additional value.
4. Three material risks that should be addressed.
5. Who should be responsible for developing and overseeing an AI Use Policy.

Then prepare a short proposal for management outlining the principal elements of a policy suited to your company’s circumstances.

Do not begin by trying to write a comprehensive policy covering every conceivable situation. Begin by understanding the company’s actual needs, establishing appropriate principles and identifying the most important risks and opportunities.

Your objective is to create a policy that allows the company to move forward confidently, rather than one that simply tells employees what they cannot do.