My test for an AI governance policy is simple. Do employees ask legal or their manager before they sign up for an AI tool? Every AI tool carries terms and data practices that can create trouble for information security, privacy and your own contracts if nobody reviews them.
To me, day-to-day AI governance means writing the policy, introducing it to employees when they join, and refreshing their training every year. It also means giving them somewhere to take a question and evaluating the tools they ask about. Together, these steps make an effective AI governance policy and build a company culture where people ask before signing up for or using an AI tool.
The model I use is similar to information security governance. Our employees take an annual information security refresher course, so AI governance should have one too. An annual AI refresher, with managers covering the policy in team calls, would keep AI risks top of mind and teach employees to ask before agreeing to a tool’s terms.
I’ll walk through recent examples of people escalating vendor terms and questions, then provide my tips for making an effective AI governance policy.
It is general information, not legal advice.
What an effective day-to-day AI governance policy looks like
A manager sends vendor AI terms for review before accepting
We’ve educated our team who use external vendor tools to send any AI terms they receive for review before clicking accept. We've been on both ends of AI terms, updating our own customer terms when we added AI tools and receiving new AI terms from our vendors.
The manager who uses each tool, such as our director of product management, sends those terms to a small review group that includes information security and me. Sometimes we ask the vendor questions about their terms, and sometimes we negotiate.
If an employee clicked accept before sending terms for review, we would have agreed to terms that legal and information security had not read, and we would have lost the chance to ask questions or negotiate.
Two C-level officers raise a question the policy doesn’t answer
AI governance policy can't answer every AI question without becoming a 400-page document that's out of date before I finish writing it. Ours tells everyone, including C-level officers, to go ask someone when the policy doesn’t answer a question.
Recently, two C-level officers from one of IntelAgree’s clients followed a policy recommended by IntelAgree to that Customer. They asked their GC about employees using AI tools. The question was broad, with no detail on which tools or how employees would access them. As an in-house lawyer, I typically get questions like this, which are framed as "what if" or "is it okay if," without enough detail to answer. That client GC reported to me that she asked follow-ups to pin down what they meant, including:
- Which AI tools would employees use?
- Would they use personal or company accounts?
- Would they reach the tools through our partner relationship or through a separate enterprise license with an AI provider?
The answers told her which terms applied, so her director of information security and the GC knew what to review. Our client GC then read the AI vendor's terms, compared notes with her internal subject matter experts, and decided together what people should and shouldn't do.
If no one had asked, those client employees would have started using those tools under terms that neither legal nor information security had read.
A vendor acquisition leads to a new rule for vendors with AI tools
Our director of product management recently told me that another company had acquired the vendor that added AI tools to our product team’s roadmap software. Our contract with that vendor was about to expire, and the acquirer sent a new order form with one-time implementation costs for us to review. The acquisition led us to a rule for vendors with AI tools.
When a new vendor with AI tools has access to our clients' information, we re-evaluate what we let it do with that information and update our data processing agreement, so customers know a new vendor has access to their data.
If someone had signed the new order form without sending it to legal first, we would have skipped that re-evaluation, and our customers would not have known a new vendor has access to their data.
Success looks like people escalating anything unfamiliar
Each time, someone brought the question, the terms or the news to me. Our policy tells people to ask, and we educate the managers who receive vendor terms. So, what does a good AI governance policy look like on an ordinary day?
Three habits show it’s sticking:
- A manager who receives a vendor's AI terms sends them for review before agreeing.
- Anyone with an AI question the policy doesn't answer asks me or information security.
- When another company acquires a vendor with AI tools, we re-evaluate the new owner's access to client information and update our data processing agreement to put customers on notice.
AI raises questions we hadn't considered a year ago, and where the policy doesn't cover them, our policy is to ask before we sign up.
Tips for making an AI governance policy work
These seven tips help you build an AI governance policy that gets employees to ask before they sign up and gives legal the knowledge to answer.
1. Use the expertise available to you
Start with the Association of Corporate Counsel's AI resources page. It covers writing an AI governance policy from scratch, evaluating AI tools, and training from many providers. Scan the page to see the full range of what's available, then go straight to the section that matches what I'm working on.
I also follow webinars and professional chat threads, plus IAPP updates as IntelAgree’s designated privacy law expert. A webinar on how courts are starting to decide whether using a public AI tool affects attorney-client privilege let me advise colleagues who asked about it. I wouldn’t have known about the issue unless I was tuned in to chat threads and other updates.
2. Write a simple policy and name an escalation point
You can’t write a 400-page policy that answers every question anyone could ask, because it takes too long to write and it’s out of date by the time you finish. In my experience, people also don't check a long policy or can't tell which answer applies, so they end up asking me anyway.
That’s why I keep our policy simple and don’t have to rewrite it every month to keep up with new AI tools. Ours names an escalation point, the place that catches what the policy can’t, giving employees a place to take unanswered questions.
3. Repeat your AI policy through existing training and meetings
Repeat the policy at onboarding, at an annual refresher and in manager team calls. New employees should read and acknowledge AI policies when they join or attend a training session on it in their first 30 days. This is the same as all other company standard policies. Every year after, an AI refresher belongs in the annual information security training. Require managers to cover the policy for 10 minutes in a weekly or monthly team call and report back.
Beyond those, we recently added a quarterly 15-minute update on governance and AI to our leadership call. Also, have every subject-matter expert, such as legal or information security, mention AI in their own trainings, even when AI isn't the topic.
4. Send vendor AI terms for review before signing
At IntelAgree, the people our vendors treat as their customers are usually senior managers, directors and vice presidents. They decide which tools to sign up for, so they need to be keenly aware that a free tool or a beta still needs review.
Before they sign up for anything or add AI to a vendor we already use, I want them to ask legal or their own manager, and to forward any AI terms for review. Without that habit, an employee can sign up for a tool and nobody finds out until the bill reaches accounting.
5. Give every request one review path, with clear branches
We send every new tool through the same review: ask follow-up questions to pin down the use, read the vendor's terms, decide together what people should and shouldn't do, and answer whoever asked. The use case decides how much evaluation it needs and sets the branch, so we ask:
- Is it for internal use only, with nothing shared outside the company? If so, does it use customer information or only ours?
- Is it for our customers' benefit?
Some branches need more discussion and evaluation than others, so we have to recognize which branch a request is on.
6. Watch for outside changes, then decide what each one means for you
When an update on AI law arrives, we can discuss it internally and decide to change our policy, change our contracts and/or keep monitoring for now. On October 7, 2026, Sen. Maria Cantwell outlined a governance framework for frontier AI. It’s an example of the updates we watch as part of an effective AI governance policy.
Lawyers, privacy professionals and security professionals all have an obligation to stay current on AI law, capabilities and technology, and I do so through webinars and chat threads.
7. Test your policy at someone's desk
To check whether the policy reached people, I'd ask someone on a team to open the tool they use every day.
Then I'd ask three questions:
- Which of these features are AI, and is it obvious when you're using them?
- Where does the data go, and have you asked the vendor?
- When you click an AI button and terms pop up, do you accept them, or did anyone review them?
The red flag is someone using AI that vendors build into their daily tool under terms that legal, security or privacy never reviewed. That tells me the AI policy didn't land with that person.
Where to start with an AI governance policy
An AI governance policy tells people what they can and can’t do, and whether they ask first tells me if it's working. If you do only one thing to make your AI governance policy work, have managers ask before they sign up for a vendor tool and forward any AI terms, and count each as a success each time one flags a link they've never seen before.
Then download the governance checklist for concrete steps on the questions to ask every vendor, where humans stay in the loop, what to keep confidential and how, and how to stay audit-ready.
Additional Reading
The One-Model Myth in AI Contract Management — Why AI contract projects stall, how to match machine learning or generative AI to each contract job, and what to get ready before you pilot.
Getting AI Contract Review Right: Tailor, Test, and Trust — A practical guide to setting up AI contract review: encoding your standards, testing the output, and knowing when to trust it.
Why Contract Compliance Breaks Down and How to Fix It — Learn why contract compliance often fails and discover effective strategies to ensure all parties meet their obligations throughout the contract lifecycle.