Building a Company AI Policy That Enables
Most AI policies are written by legal or compliance teams with the primary goal of risk mitigation. The result is a policy that a reasonable employee reads and concludes: "I should use AI as little as possible to avoid violating this." That's the opposite of what the organization needs.
An enabling AI policy starts with a different goal: how do we capture the maximum value from AI while protecting against the risks that actually matter?
The structure of an enabling policy
Section 1: What we want to achieve. A statement of organizational intent — we want to use AI to accelerate our programs, reduce administrative burden, and improve the quality of our work. This section exists to communicate leadership's intent clearly, so employees understand that the policy is designed to enable, not to restrict.
Section 2: Data handling. The data tier classification from the previous lesson, applied to your specific organization's data. Which systems can be used with which data tiers. This section should be clear enough that a non-legal employee can apply it without interpretation.
Section 3: Approved use cases. A list of use cases that have been reviewed and are approved for use without additional review. Organized by function (regulatory, clinical, chemistry, G&A) and data tier. When an employee's use case is on the list, they don't need to ask — they can proceed.
Section 4: Use cases requiring review. Novel use cases, high-risk use cases (those involving Tier 3 or 4 data, those producing outputs for regulatory submission), and use cases involving external stakeholders require review. The review process should be fast — target 48-hour response for most requests.
Section 5: What's not allowed. A short, specific list of things that are genuinely prohibited: patient data in consumer AI tools, competitor confidential information, securities-material non-public information. Short and specific is more effective than long and comprehensive.
Section 6: How to get help. Who to ask when unsure. This section reduces the "ask forgiveness rather than permission" pattern that creates governance risk.
The update cycle
AI capabilities and risks change faster than annual policy cycles. Commit to quarterly review and update. Communicate updates clearly — employees who adopted AI based on the old policy need to know what changed.