I talked to a business owner last month who told me they’d decided to “just ban AI” at their company. No ChatGPT. No Copilot. No AI tools of any kind.
I asked how that was going.
“Honestly? I have no idea if anyone’s following the policy.”
That’s the problem with prohibition: it doesn’t work. Employees who find tools useful will use them regardless of policy. The only difference is whether they do it openly or hide it.
Why Most AI Policies Fail
I’ve seen a lot of AI policies over the past year. The ones that fail share common characteristics:
They try to ban everything. This ignores the reality that AI tools provide genuine productivity benefits. When policies conflict with getting work done, work wins.
They’re written by legal teams in isolation. Policies filled with legalese that nobody reads don’t change behavior. They just provide CYA documentation.
They don’t distinguish between different types of AI use. Using AI to draft a marketing email is different from using AI to analyze customer health records. Policies that treat all AI use identically miss the nuance.
They require approval processes that create friction. If using an approved AI tool requires submitting a request and waiting three days for approval, employees will use unapproved tools with zero wait time.
The policies that work look completely different.
What Actually Works
The businesses I’ve seen successfully manage AI adoption share a different approach:
They start with data classification, not tool restrictions. Before deciding which AI tools are acceptable, they define what data is sensitive. Customer information. Financial records. Proprietary processes. Employee data. Once you know what needs protection, you can evaluate tools based on how they handle that specific information.
They approve specific tools rather than categories. Instead of saying “you can use AI for X but not Y,” they identify specific tools that meet their security requirements. “Use Microsoft Copilot for document work. Use Claude for analysis. Don’t paste customer data into any AI tool.”
They make compliance easier than non-compliance. If the approved AI tool is readily available and works well, employees have no reason to seek alternatives. If the approved tool requires jumping through hoops while ChatGPT is two clicks away, you’ve already lost.
They train on principles, not just rules. Employees who understand why AI governance matters make better decisions in situations the policy doesn’t explicitly cover. “This data is sensitive because…” is more effective than “Don’t do this because the policy says so.”
A Practical Framework
Here’s what I recommend for businesses that want AI governance without bureaucratic overhead:
Tier 1: Public information. Marketing content, general research, public-facing communications. These can use any reputable AI tool with minimal restrictions.
Tier 2: Internal information. Internal processes, non-sensitive business data, general productivity tasks. These should use approved enterprise tools with business accounts, not personal subscriptions.
Tier 3: Sensitive information. Customer data, financial records, employee information, proprietary processes. These either require specially configured AI tools with appropriate data handling agreements, or they don’t touch AI at all.
The framework is simple: know what category your data falls into, and you know what tools you can use with it.
The Training Component
Policies without training are just documents. The businesses that make this work invest time in helping employees understand the why.
Why does it matter where data is processed? Because AI tools send information to external servers that you don’t control.
Why do enterprise tools cost more? Because they come with data handling agreements, admin controls, and compliance features that free tiers don’t include.
Why can’t we just use whatever’s convenient? Because convenience without security creates risk that compounds over time.
When employees understand the reasoning, they become partners in governance rather than obstacles to it.
Making It Real
I’ll be honest: creating an AI policy isn’t the hard part. Following through is. You need to actually provide the approved tools. You need to train people on using them. You need to check periodically whether the policy is being followed or ignored.
The businesses that succeed treat AI governance as an ongoing process, not a one-time project. They review their approved tools quarterly. They survey employees about what’s working and what’s not. They adjust based on what they learn.
The businesses that fail publish a policy, send an all-hands email, and assume the job is done.
Where to Start
If you don’t have AI governance yet, here’s the minimum viable approach:
This week: Find out what AI tools employees are actually using. Ask directly. You might be surprised.
This month: Classify your data. What’s public? What’s internal? What’s sensitive? Most organizations already have some sense of this from other compliance work.
This quarter: Identify approved tools for each data tier. Make them available. Train employees on using them.
That’s it. Not a 40-page policy document. Not a committee that meets for six months. Just clarity about what data matters and what tools are acceptable.
AI governance doesn’t have to mean red tape. It just means intentional decisions about how powerful tools interact with your information.
What’s working at your organization? What’s not? I’m always interested in hearing what other business leaders are learning.
The centrexIT team brings decades of combined IT expertise, helping San Diego businesses thrive with secure, reliable technology solutions.
Meet Our Team