Your employees are already using ChatGPT for work. They’re drafting emails, summarizing documents, generating reports, and troubleshooting problems — with or without your permission. Your vendors are embedding AI into tools you already pay for, often without explicit notification. As of 2026, only about 28% of organizations have a formal AI policy. That means the vast majority are operating without guardrails. Without a policy, you don’t have governance — you have hope. Hope that nobody pastes employee SSNs into a public AI tool. Hope that managers aren’t using AI to make termination decisions. Hope isn’t a strategy.

An acceptable use policy needs three components: approved tools (which AI products are sanctioned), approved uses (what tasks are permitted), and required disclosures (when employees must flag that AI was used). The goal isn’t to ban everything — it’s to create clear lanes. Employees work better when they know the rules, and most want guardrails on something this new.

Always disclose: AI-generated content in external communications, AI-assisted employment decisions, AI-generated candidate assessments, AI-drafted legal or compliance documents

Optional disclosure: AI-assisted internal drafts, AI grammar/editing assistance, AI-summarized meeting notes

The biggest risk with AI isn’t that employees use it — it’s what data they feed into it. A recruiter summarizing a public job posting in ChatGPT? Low risk. A benefits analyst pasting employee health information into the same tool? Catastrophic. Your data classification determines which AI tools can touch which data. Without it, you’re trusting every employee to make that judgment call in the moment.

AI governance can’t live in one department. It requires a cross-functional model. RACI defines who does what:

Responsible: Does the work. For AI, this is often HR ops (policy writing), IT (tool implementation), or the business unit using the tool.
Accountable: Has final authority. Typically the CHRO or COO for HR AI, CIO/CISO for data security.
Consulted: Provides input. Legal, compliance, DEI, employee relations.
Informed: Needs to know. Employees, managers, the board.

AI tools are incredibly easy to adopt. A free trial, a Chrome extension, a Slack integration — and suddenly confidential HR data is flowing to a vendor you’ve never vetted. Procurement policy for AI isn’t about slowing innovation — it’s about ensuring the tools you adopt are safe to use with your data. Every AI tool that touches employee data needs to go through a structured review before deployment.

Employees have a right to know when AI is being used in decisions that affect them — and in many jurisdictions, it’s the law. NYC Local Law 144 requires employers to notify candidates when AI is used in hiring and provide bias audit results. California CRD regulations (Oct 2025) require meaningful human oversight and alternative assessments. Colorado’s replacement AI law (SB 26-189, effective Jan 2027) requires transparency and appeal rights for automated decisions. Illinois and Maryland have similar requirements. The EU AI Act classifies employment AI as “high risk” with extensive transparency requirements. Even where not legally required, transparency builds trust.

NYC Local 144 requires:
• 10 business days notice before using AEDT in hiring
• Published bias audit results (updated annually)
• Information about data retention and alternative process

Even outside NYC, best practice is to disclose AI use in the hiring process. Candidates are increasingly asking — and their trust matters for your employer brand.

The fastest way to kill an AI policy is to make it rigid. A policy without an exception process becomes a policy people ignore. AI moves too fast for a static document to cover every scenario. A manager will need to use an unapproved tool for a time-sensitive project. A vendor will add an AI feature mid-contract. A new regulation will create requirements your policy doesn’t address. Build the exception process before you need it.

1. Request: Requester fills out a standard form describing the use case, tool, data involved, and timeline
2. Assessment: Security and legal do a rapid review (SLA: 5 business days)
3. Decision: Governance committee approves, denies, or grants temporary approval with conditions
4. Documentation: All exceptions logged with expiration dates and review triggers
5. Follow-up: Temporary exceptions auto-expire and require renewal

The single biggest mistake organizations make is framing their AI policy as a ban. “This is guardrails, not a ban.” Guardrails keep you on the road — they don’t stop you from driving. Your policy should feel like enablement with safety measures, not a list of things people can’t do. Lead with what employees can do, then explain the boundaries. Acknowledge that AI is a powerful tool and the policy exists to help people use it well.

Week 1: Executive announcement — brief, positive, links to full policy
Week 2: Manager toolkit — talking points, FAQ, how to handle team questions
Week 3: Town halls by business unit — Q&A, live demos of approved tools
Week 4: Training sessions — hands-on practice with approved tools and guidelines
Ongoing: FAQ document (living), Slack/Teams channel for questions, monthly tips