Perspectives
An AI policy nobody can follow is not a policy
Write the rule where the work happens.
By Ehsan Gazar, 23 October 2026
Your company has an AI policy. It is twelve pages long, it was signed off in the spring, and it lives in a folder most people have never opened.
Ask anyone on the team whether they may paste a supplier's invoice into a chatbot. They will not know, and the policy will not tell them quickly.
A rule people cannot apply at the moment they need it is not a rule. It is a document that protects the author.
Why the long policy fails
Most AI policies are written to cover every case. That is why nobody can use them.
The length is not the author's fault. A policy written for legal review has to be defensible, and defensible means complete.
Long policies speak in categories: personal data, commercially sensitive information, regulated content. The person at the keyboard has none of those. They have a contract, a spreadsheet of customer emails and a draft letter to a supplier.
Turning one into the other takes judgement, time and a careful reading of page seven. At three o'clock with a deadline, nobody does it.
So people either stop using AI, or they use it and hope. Neither is what the policy was for.
Three answers, sorted by the people who do the work
A policy people can follow answers one question about their own tasks: may I put this into an AI tool?
There are only three useful answers. Safe, which means go ahead. Careful, which means only in the company tool and with something removed first. Never, which means not in any tool at all.
The examples have to come from the team's own week. "Customer data" is a category. "The renewal list with names and phone numbers" is something a person recognises at once.
That sorting is done by the people who do the work, not written for them. In the AI for Teams workshop from AI Enablement, each team sorts real examples from its own work into safe, careful and never.
The careful list matters most. It holds the real decisions, such as a contract with the prices removed, or a customer email with the name taken out.
What they leave with is a one-page guide in their own words. It is short enough to remember, and specific enough to settle the invoice question in a second.
Some rules should never depend on somebody remembering them. A company tool can hold those, so the page does not have to.
"Use the company tool, not a personal account" is the first. In Vatan, people sign in to the workspace through the company's own identity provider, and the Assistant is there with models from several providers.
"Never paste card numbers or bank details" is the second. Redaction on the Vatan gateway finds identifiers with a fixed shape, such as email addresses, card numbers, IBANs and National Insurance numbers.
It either replaces each one with a placeholder before the message leaves, or refuses the message whole. It is off until the workspace switches it on. The placeholder keeps the sentence useful: a model asked to draft a reply to [EMAIL] can still draft it.
"Only these teams may use AI for this" is the third. Access to the Assistant is a permission set per team, and each team can have its own budget.
"We need to know how AI is being used" is the fourth. Every request leaves a usage record with its tokens, cost and timing, and never the prompt itself.
Each of these takes a line out of the policy and puts it where it cannot be forgotten. What is left for people to remember gets shorter.
The rules only people can keep
A tool can find a card number. It cannot tell that a paragraph describes an employee's illness, or that a draft is about to promise something legal has not approved.
Those rules stay with people, and they are the ones worth teaching. Check every number against the source. Never let AI make a final decision about a person. Do not send legal wording that nobody has read.
Judgement like this improves with practice on real examples, not with a longer document.
A short policy can say all of that on one page, because the rules a tool already holds no longer need a paragraph each.
Keeping it true
A policy goes stale the day a team starts a new kind of task. The renewal list moves to a new system, or somebody starts drafting tenders.
The simplest fix is to treat the "careful" list as the one to watch. Read it with each team every few months, and ask what people actually did with each item. When something new lands there more than once, either the company tool learns to handle it, or it becomes a clear "never".
That keeps the page short, because each rule a tool takes over leaves the policy.
A policy people can follow is shorter than the one they ignore, because the tool holds the rest.