Writing an AI policy project teams actually follow

The situation

A delivery organization working with sensitive data had responded to AI by banning it. Teams used it anyway, on personal devices, which was the worst of both worlds. Leadership wanted a policy, and the first draft from legal ran to forty pages.

What changed

The policy was rewritten around the questions project teams actually ask: can I put this document in? can I use this output in a client deliverable? who checks it? what do I do when it is wrong? Each answer came with a worked example from the organization’s own projects. Approved tools were listed, with the reason each was approved. The BRIEF method was taught alongside the policy so people learned to use AI well, not just permissibly.

The result

Usage moved onto approved platforms within weeks because the approved route was now easier than the shadow one. Audit questions about AI use could be answered from a log. The policy is reviewed quarterly, and the review takes an hour.

What it teaches

• A policy people can remember beats one they cannot find.
• Approve a good route and the shadow route dies on its own.
• Policy and skill must be taught together.

A composite drawn from our engagement work and published practice. Details are generalized and no client is identified.