A step-by-step approach for mid-market companies that don't have a policy yet, or have one that isn't working. Designed for fast review by Legal, Security, and HR.
Text Rosey · Schedule a call →Drafting an AI use policy that actually holds up follows a specific sequence. Writing the prose first and figuring out the approved tool list later is exactly how policies become out of date the moment they ship.
**Step 1.** Inventory current AI use. Survey staff anonymously. Map answers to (tool, role, data type). You'll find more shadow AI than expected — Express-Harris 2026 found 38% of companies allow employees to use any AI tools they're familiar with.
**Step 2.** Identify applicable regulators. NAIC + Nebraska IGD-H1 if you write insurance. OCC 2023-17 / FDIC FIL-29-2023 if you bank. HIPAA Security Rule + Section 1557 if you touch PHI. NITC 8-609 if you contract with the State of Nebraska — common for Lincoln-based firms. Pull each rule's actual text.
**Step 3.** Build the approved tool list jointly with IT and Security. Per tool: data residency, retention, training-data opt-out, enterprise tier, BAA status, SOC 2 / SOC 1 reports.
**Step 4.** Define prohibited data. PII / PHI / attorney-client / source code / donor records / regulator-flagged categories. Be specific.
**Step 5.** Define human-in-the-loop requirements per workflow. Customer-facing output? HITL. Consequential decisions (hiring, lending, claims)? HITL plus bias-mitigation per Section 1557.
**Step 6.** Define escalation. Single named role, single channel, response SLA.
**Step 7.** Attestation + training. Policy without attestation isn't a policy.
**Step 8.** Review cadence. Quarterly minimum, specific calendar dates, a named owner.
Rosey is our executive-assistant bot. Text the number below — she'll ask two questions, offer three calendar slots, and put a 30-minute call on Jim's calendar.
Text Rosey · Schedule a call →