Most organisations using AI now have an AI policy. Many of them are long, careful and ignored. Meanwhile people paste customer data into whatever tool is on their phone, because it's faster than asking.
That isn't a discipline problem. It's a design problem. People follow rules that are easier to follow than to break. Governance that slows everything down doesn't stop AI use. It moves it somewhere you can't see.
Start with what's already happening
Shadow AI isn't a future risk. It's the current state. Before writing rules, find out what people use, for what, and with which data. Ask without blame. You only get honest answers if people believe the point is to give them better tools, not to catch them.
The answers usually show two things. Most use is low risk, like drafting, summarising and searching. And a small share touches data that really matters, such as customer records, health data, contracts or source code. Governance should spend its effort on the second group.
Three tiers are enough
Most organisations can work with three.
Free to use. Approved tools, no sensitive data. Writing, research, brainstorming. No approval needed, and a short guide is enough.
Use with care. Approved tools with internal or personal data, within set limits. Needs enterprise accounts with data retention under control, and a named owner for the use case.
Needs review. Anything that makes or shapes decisions about people, touches regulated data or faces customers. Goes through a short review before it runs.
The tiers do the work. Most requests land in the first one and never need a meeting.
Make the approved route the fast route
The test for any approval process is whether it's faster than the workaround. If a team needs a tool this week and the review takes three months, they'll find a way around it.
A review for the third tier that takes days, not months. One form, one owner, one decision.
Enterprise accounts for the approved tools, so nobody needs a personal one.
A visible list of what's approved and what's on the way, so people can see the route works.
Keep the policy short
If the policy runs past two pages, people won't read it. The core fits on one. Which tools are approved. What data can go into them. What needs review. Who to ask. Detail belongs in guidance for specific roles, not in the policy everyone has to know.
Literacy is part of governance
Since February 2025 the EU AI Act has required organisations that use AI to make sure their staff have a sufficient level of AI literacy. That's a legal duty, and it's also the most effective control you have. People who understand what a tool does with their data make better choices than any rule can force.
One owner
Governance spread across IT, legal and data protection, with nobody holding the whole, tends to move at the speed of the slowest of the three. One person needs to own the tiers, the approval route and the list, and to change them when they stop working.
That's part of the CAIO role. More on what a Chief AI Officer actually owns, and on the order to put it in place in the first ninety days.