Your organisation needs an AI policy. What happens next?

What do people need to know before using AI?

A recent CyberSolace engagement highlighted that staff need different guidance from those approving tools and overseeing risk.

Staff guidance can cover approved tools, information boundaries, output checks and where to ask for help. A management framework can cover approvals, supplier checks and review.

Before sharing information, ask who it could identify, whose information it is, where it is going, whether less would do and who will check the output. Removing a name does not necessarily make it anonymous; other details may still identify someone.

Key takeaway: People need guidance they can apply before they paste.

How much review does each AI use need?

Improving public text differs from ranking applicants, analysing sensitive records or speaking for an organisation. Controls should reflect the information, purpose and possible effects—not the product name alone.

An organisation can distinguish low-risk tasks, routine uses needing an approved tool, higher-impact uses requiring documented review, and uses it will not permit. These are management choices, not a substitute for the EU AI Act’s legal classifications.

An organisation may prohibit a use because it falls outside its risk appetite, even where there is no blanket legal ban.

Key takeaway: Match the control to the consequences of the use.

What should you check before approving a tool?

Existing email, document, meeting or customer-service software may add AI features. A familiar supplier or licence does not establish that a feature is suitable for every purpose.

Check what information the service receives, who can access it, retention and deletion, whether inputs or outputs may develop the service, and the actual account’s contract and settings. If an assistant can act, consider its access to mailboxes, files and other systems.

Record approved purposes, accounts, data limits and settings in a short tools list. The Information Commissioner’s Office guidance discusses accountability and privacy in AI procurement.

Key takeaway: An approved tool still needs boundaries for its approved use.

Explore your organisation’s controls with our AI self-assessment.

Who checks the output and makes the decision?

A responsible person needs the authority, time and information to question an AI recommendation. If they cannot inspect its basis or disagree with it, their involvement may offer less assurance than expected.

For significant decisions, establish who decides, what they check and how challenges are handled. Before publication, verify important claims and references: fluent text and plausible citations can be wrong.

Why it matters: A person’s name on a process is only useful if they can exercise judgement.

Key takeaway: Human oversight needs the ability to question and correct.

Which rules may apply to your AI use?

Data protection rules and the EU AI Act address different questions. The obligations depend on the specific information, system, role and circumstances.

Why it matters: A policy should help identify when a proposed use needs specialist review.

Key takeaway: Check the rules against the actual use and your organisation’s role.

How do you keep the policy useful?

As tools change and experiments become routine, start with a named owner, a record of approved uses, a route for questions and incidents, and regular discussion. Review a use when its purpose, data, supplier terms or access changes.

A SHRM article on putting an AI policy into practice highlights ownership, education, feedback and review. It distinguishes adoption from quality, risk and business value: more usage alone does not show whether a tool is delivering worthwhile outcomes safely.

Ask staff what is difficult; unapproved use may indicate that an approved tool does not meet a genuine need. Monitoring should be proportionate and respectful of privacy.

Key takeaway: Ownership and feedback make review possible.

What should you discuss first?

Identify what is known, what needs checking and who will act.

• ☐ Where is AI already used, including in existing software?
• ☐ What information can those tools receive, and what happens to it?
• ☐ Which uses could affect people, confidentiality, decisions or reputation?
• ☐ Who approves a new use and remains accountable?
• ☐ What guidance and training do staff and managers need?
• ☐ How can someone report an error or disclosure and get help?
• ☐ When will you review the tools, safeguards and policy?

Key takeaway: A first discussion can identify owners and next steps.