One-Page AI Policy Template for Founders

Employees at a major electronics manufacturer entered confidential material into public generative AI tools. No policy existed. The result was an internal information leak, documented by NTT DATA. The harm did not wait for use cases to mature.

The argument for waiting is wrong

The timing argument goes like this: write rules after you understand how your team uses AI, not before. McKinsey's data gives it surface plausibility. Only 23% of organizations reported that at least 5% of their earnings came from AI use, while 79% of workers had some exposure. Most teams are still experimenting. Why govern an experiment?

Because the experiment is already leaking. Ivanti's analysis of generative AI security risks names five specific failure modes that appear during unstructured experimentation, not after it: sensitive data leakage, prompt injection, unauthorized data retrieval, context leakage, and weak logging. Sensitive data leakage happens when employees paste confidential information into prompts fed to tools outside your infrastructure. Prompt injection involves hidden instructions in content that redirect a model to bypass safeguards. Unauthorized data retrieval occurs when AI applications connect to document repositories with misconfigured permissions. Waiting for use cases to clarify does not pause any of these. It extends the period of unmonitored exposure.

What the compliance research actually shows

Behavioural research on information security policies produces a consistent finding: long, abstract policies reduce engagement, while short, plain-language rules with credible enforcement increase actual compliance. This is not an argument for comprehensive governance. It is an argument for a specific format. A one-page policy written in plain language, with named tools and named prohibitions, is the version employees read. A 40-page framework is the version they don't.

I find most AI governance templates on the market genuinely useless. They read like they were written by a compliance team for a compliance audit, not for a product manager who copied a client email into ChatGPT at 11pm. The vocabulary is wrong. The length is wrong. The format is wrong.

What the one-page policy needs to contain

Templates from HR platforms and security vendors converge on three elements. First, a list of approved tools by name. Not "approved AI tools" as a category. ChatGPT, Copilot, Claude — named, versioned where relevant, with a note on which require enterprise accounts with data processing agreements in place. Second, explicit data prohibitions tied to categories employees already recognize: client names, financial records, source code, anything marked confidential under your existing classification scheme. Third, an escalation path. One named person or role, one contact method, one sentence on what triggers escalation. A new integration that sends data to an external service. An output that will reach a client without human review.

The steelman against this is real and worth stating plainly. A one-page policy does not address output verification, bias in model responses, or accountability when an AI-assisted decision harms a client. The OECD AI Recommendation demands transparency, explainability, and accountability from AI actors. A list of approved tools and a data prohibition does not satisfy those obligations. A founder who tells a client "we have an AI use policy" while leaving output-verification obligations unaddressed has created the appearance of governance, not the substance. This article is not arguing otherwise. The one-page policy covers the exposure that causes irreversible damage during the first six months of informal adoption. Bias and accountability governance come next, built on top of a foundation that at least stops employees from pasting client contracts into public chatbots.

The window is shorter than it looks

McKinsey's survey shows that adoption remained concentrated in marketing, product development, and service operations, with fewer than a third of organizations reporting AI use across more than one business function. That unevenness is the condition where shadow use spreads fastest. The functions that haven't adopted yet are the ones where employees experiment informally, without IT visibility, using personal accounts on public tools.

Publish the policy before those functions start experimenting. Post it where new employees find it during onboarding. Name the person responsible for escalations. Review the approved tool list every quarter, because the tool your team adopts in month three is probably not the one you named in month one.