The company-wide AI usage guideline - written before it was asked for (2026)

The situation

Seven operating areas run out of one organisation: an automotive publication with its own social platform, a social media management agency, a SaaS division, events, photography and videography, in-house IT, and a creative team producing AI-generated image, video and copy - supported by finance, admin and HR, and by a group legal function. Every one of them had already started using AI independently, on their own accounts, against their own judgement. Nobody had asked for a policy. The agreements we had been signing since 2025 already stated our AI use to clients, defined permitted purposes, specified account tiers and addressed meeting recording - so the company had made external commitments it had no internal standard to honour. That gap was mine to notice, so I wrote the instrument.

The read

Most corporate AI policies are written against two risks - data leakage and inaccurate output - and both are the easy half, because both have technical controls. The harder problems are organisational: which tool for which class of data, what context a model must be given before it can be trusted with a task, what gets disclosed and what does not, whose approval is needed before a use goes live, and what happens when something goes wrong. A policy that only prohibits produces shadow usage. A policy that only permits produces incidents.

What I did

Drafted a single guideline covering all seven areas: approved tools and account tiers mapped to a data classification scheme; mandatory context priming through an onboarding toolkit, so a model is briefed on our policies and our business before it is asked to work; divisional standards written separately for editorial, agency, creative, SaaS, events, media production, IT, finance, HR and commercial-legal operations, because a rule that fits the newsroom does not fit the contracts desk; disclosure and labelling calibrated to where it changes how a reader should treat the material, rather than blanket labelling that devalues the label; a client AI restrictions register with contractual flow-down to vendors, freelancers and agency partners; prohibited uses and review tiers; and governance, audit, incident handling and a quarterly review cadence with named roles. Meeting recording and transcript processing was given its own architecture (case study below).

The outcome

Drafted and submitted to both co-CEOs and group legal counsel for review. My team and I already operate to it in advance of approval - the standard held before it was mandated, which is usually how a policy finds out whether it is workable. The internal operating standard and the contractual position now agree with each other, in the direction that is normally reversed.

What this shows

AI governance as operating-model design rather than compliance drafting - written unprompted, covering nine functions with genuinely different risk profiles, and reconciled with commitments the company had already made to its clients.