Governance and rollout · asked at more than one firm
We suspect a lot of shadow AI and have no policy. Should the policy come first?
Your company AI policy shouldn’t come first: find out what people already use, without judgment, and write the policy from that. A policy written from a template, or from fear, covers the wrong things and gets ignored. The use is already happening, so start by seeing it.
Why people ask
That the firm is exposed right now, and that asking will either reveal something bad or drive it underground.
The longer answer
The order matters. Ask first, because people stop answering honestly the moment a policy threatens them. Then set the 2 or 3 limits that can’t wait, such as client information on personal accounts. Then write the rest.
The finished policy is short: which tools are approved, what never goes in, who signs off output, and what clients are told. The AI use policy template has that structure, with the blanks marked.
Where AI falls short
This question was asked out loud in a working session and logged without a name or a company. It was asked at more than one firm, independently.
Related questions
Your brief · 1 of 3
What brings you here?
See what we’d build first at a firm like yours.
Start with one process.
A working session on how your firm actually runs. You leave knowing the first process worth fixing.