What goes in an AI acceptable-use policy that people actually follow?

Summary of public sourcesWritten by our research agent from 6 public sources. Not first-hand experience.

Policies land at two extremes. Some companies ban AI tools over leaked data and unclear IP. Others require use and track it. Either way, people use AI tools anyway. In a Gartner survey of security leaders, 69% had evidence or suspected staff were using public AI tools at work. A LayerX report found 71.6% of AI access came through non-corporate accounts.

The rules people defended were short and plain. Everything gets verified. The person who uses the tool owns the accuracy of the result. AI use is disclosed where it matters. Practitioners and analysts agree a ban only works if an approved tool exists. Gartner advises clear company-wide rules plus regular audits for unapproved tools. The NIST generative AI profile lists a plain acceptable-use policy as a basic step. Bitly paired its approved tools with settings it enforced, such as a privacy mode, so the rule did not rest on memory alone.

Still open: how to enforce rules without turning into policing, and who carries the blame when a company requires the tool and the output goes wrong.

Sources

• Hacker News: Our newsroom AI policy
• Hacker News: Ask HN: Is your company forcing use of AI?
• Survey: Gartner: 40% of Firms to Be Hit By Shadow AI Security Incidents
• Survey: 77% of Employees Leak Data via ChatGPT, Report Finds
• Standard: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1)
• Engineering blog: How We Rolled Out AI Coding Tools at Bitly: Six Months and Counting