Illustrative scenario. An analyst pastes a client memo into a free AI tool for a cleaner summary. The memo includes screening criteria, a price range, and an assessment of a target the firm would not share outside the room. The summary saves time. The firm may have no record of where the memo went.
That is the problem with tools adopted without review. Employees find something useful and put it to work before the firm has decided what information it can receive.
IBM’s 2025 Cost of a Data Breach Report studied 600 organizations that experienced breaches between March 2024 and February 2025. One in five of those organizations reported a breach linked to shadow AI, meaning AI used without employer approval or oversight. Organizations with high levels of shadow AI had average breach costs $670,000 higher than those with low levels or none. Among the breached organizations studied, 63% had no AI governance policy or were still developing one. (IBM report findings)
Find the tools before writing the policy
The inventory should show which tools staff use, what each tool does, and what information it receives.
Look for:
- Browser extensions that call external models
- Personal accounts on public AI platforms used for work
- AI features in software the firm already pays for
- Internal prototypes or scripts connected to external APIs
Use that record to decide which tools and uses the firm will approve.
One page, two lists
Put the main rules on one page so staff can check them before submitting a prompt. This employee-facing summary supplements any required security program or incident-response procedures.
- What can go in. Public information, published material, and generic process questions. Use the firm’s approval rules to decide what belongs in each tool.
- What cannot. Deal terms, unreleased financials, client-identifying information, screening criteria, and legal strategy. Keep this material out of tools the firm has not approved to receive it.
Spell out what is allowed, what is restricted, and whom to ask when a case is unclear.
Train staff on the work they do
Work through examples staff will recognize from their own jobs.
Show what staff must remove before submitting a memo or query and which work requires a tool approved for that information. Give them a contact for questions the policy does not cover.