Building AI rules the business will actually use.

Nobody reads the binder. Everybody uses the tools.

In most companies, AI usage is already ahead of AI policy — usually by a year or more. Employees paste data into whatever tool answers fastest; managers quietly expense subscriptions; entire workflows come to depend on tools no one sanctioned. Meanwhile the governance document, if it exists, runs forty pages and has been read in full by its author and the lawyer who reviewed it. This is the worst of both worlds: real exposure, plus the illusion of control.

The instinct to respond with a bigger, stricter policy misreads the failure. The binder does not fail because it is too permissive; it fails because it is unusable at the moment of decision. A marketer with a deadline and a draft in hand will not consult chapter seven. She will do what seems reasonable — and “reasonable” without guidance is whatever the tool’s default settings allow. Policy that cannot be recalled from memory at the moment of use is not policy; it is documentation.

FOUR PRINCIPLES

What actually goes wrong — and what merely sounds alarming.

Effective rules are proportionate to real failure modes, so it is worth being precise about them. Across incidents we have reviewed and remediated, four patterns account for nearly all the damage.

The dominant risk by frequency. Customer PII, unreleased financials, source code, and credentials pasted into consumer-grade tools, where retention terms are unread and accounts are personal. The exposure is usually invisible until an audit, a breach disclosure, or a vendor’s training-data announcement makes it visible all at once.

AI output is fluent, and fluency reads as competence. Unreviewed, it finds its way into client deliverables, filings, and published numbers. The failure is rarely the model — it is the absence of a stated review gate at the boundary where output leaves the company.

Tools differ enormously in what they retain, train on, and sub-process. A sanctioned list is, at bottom, a statement that someone read the terms so that four hundred employees did not each have to.

When something does go wrong, organizations without named ownership spend the first week discovering that no one is responsible for responding. The incident is survivable; the vacuum is what turns it into a crisis.

Five sections cover everything that matters.

Every durable rule set begins with a name: one accountable executive, one operating owner for day-to-day questions, and the channel for reaching them with a committed response time. Policies without a named human are suggestions — the moment a question has nowhere to go, users answer it themselves, and each self-answer is a precedent the organization never sees.

“Approved” must mean a list: specific products, each tied to what it is approved for, under company accounts. The request path matters more than the list itself. Organizations that promise an answer inside a week see shadow usage collapse, because the sanctioned route is finally faster than the workaround. Organizations that route requests through a quarterly committee see the list ignored — politely, then habitually.

Three classes suffice for almost any mid-market business: public, internal, restricted. The rules state which class may enter which tool, and then — critically — name the restricted items concretely: customer PII, unreleased financials, credentials, M&A material. Users follow examples, not taxonomies. A boundary illustrated with five familiar items is worth a page of classification theory, because it can be recalled at the moment of pasting.

Place review where the risk lives. Make reporting safe.

The review section is a short, closed list of outputs that always require sign-off before they count: anything customer-facing, anything filed with a regulator, anything that moves money, plus whatever is company-specific — pricing, medical content, safety documentation. Everything else ships on the author’s judgment, exactly as it did before AI. The temptation to require review of everything should be resisted on safety grounds, not just efficiency: blanket review at volume decays into rubber-stamping within weeks, which preserves the cost of review while destroying its value. A reviewer who approves two hundred items a day is not a control; he is a formality with a login.

The final section states where usage is visible and how mistakes are reported: within 24 hours, through a named channel, with an explicit no-blame commitment for self-reported errors. This is the section that determines whether leadership ever learns what is actually happening. People report what they will not be punished for; an organization that punishes disclosure trains its staff to hide precisely the incidents it most needs to see. The 24-hour window matters too — it frames reporting as routine hygiene rather than confession.

Adoption is a design problem, not a compliance problem.

The binder model assumes rules are adopted because they are published. Two decades of corporate policy suggest otherwise: rules are adopted when they arrive attached to something useful, when the environment enforces them invisibly, and when they visibly learn from their own failures.

Launch with the carrot. Introduce the rules alongside a sanctioned tool people genuinely want — the capability and the boundary in the same breath. A rule set that arrives as pure restriction is received as one; a rule set that arrives with the good tool reads as the price of admission, gladly paid.

Enforce in tooling, not memos. Access controls, data-loss prevention, and usage logging do the policing quietly; the one-pager exists to make the logic legible enough to trust. When the environment blocks the restricted paste, the rule does not depend on memory or virtue.

Review quarterly, and prune. A rule nobody follows is either wrong or unenforced — fix it or delete it. Stale rules are not neutral; they teach users that the document as a whole is optional.

Governance that lives in tooling and one page of plain language beats a binder every time.

The skeleton, ready to fill in.

Michael Yakubin · Founder & CEO

michael@platinumstrategygroup.com

WWW.PSG-INC.COM