Ask four people at your company what the AI policy is. You'll get four answers, or a shrug.

That isn't a policy. It's a feeling.

Usually, it's some version of be careful with company data, said once, in a meeting, eighteen months ago, or it was sent out in an email a year ago.

Here's what makes it expensive. The statistics say your team is already using these tools. Someone is drafting copy, someone is cleaning up a spreadsheet, someone is pulling data, someone pasted a client contract in to get it summarized before a call. None of them are being reckless. They are doing their jobs faster with tools nobody told them not to use.

But most of them are signed in on a personal account, because that's the account they already had. Consumer tiers and business tiers do not treat what you type the same way. The defaults differ by vendor, and they change. Almost nobody at a small company knows which one their people are on — and that isn't the team's failure. Nobody ever told them there was a difference.

Tuesday, I wrote about checking a claim before you act on it. This is the decision on the other side of it.

You don't need a governance program. You need one page that four people can recite.

Which tools are approved. Named, not categories. "These two. Anything else, ask first."

Which account. The company account, never a personal one. This line does more work than the other three combined.

What never goes in, whatever the tool. Anything under a client contract or an NDA. Personal data — customer records, employee files, anything medical or financial. Credentials. The test people actually remember: if you'd panic about emailing it to a competitor by accident, it doesn't go in.

Who to ask. One name. A rule with nobody's name on it is decorative.

That's the page. Writing it takes an afternoon. The hard part isn't the writing — it's deciding which tools you're actually approving, which means somebody has to go read what the terms currently say. That's the work. Do it once a quarter, because it moves.

What I keep taking from it: the policies that hold are the ones people can carry in their head while they're working. Twelve pages in a shared drive governs nothing. Four lines governs, because it's short enough to surface at the moment the decision actually gets made — which is someone with a deadline and something already in the paste buffer.

In a smaller company, nobody owns this by title. That doesn't make it someone else's.

The exposure was never that your team is using AI. It's that nobody told them where the line was.