Is Your AI Policy Slop?

Unless you drafted it after January 2026, your AI policy is almost certainly out of date, and so is the AI policy of nearly every one of your clients.  The reason for this abrupt and radical shift is quite simple: the capabilities of commercial AI tools expanded dramatically after new models were introduced earlier this year, in particular the now ubiquitous Claude Cowork, and other similarly powerful agentic platforms.  What had been, for many users, a simple chatbot only a few degrees beyond a Google search, or a fancier version of a meme generator, suddenly became something else entirely.  What that “something else” actually is remains a matter of genuine controversy in the world of academics and AI aficionados, but for lawyers and their clients the important thing was that it is a black box, that it has the power to perform autonomous tasks, and it is widely used by people who neither fully understand its limitations nor its power.

What Should an AI Policy Do?

An AI policy is ultimately a framework to guide employees on the use of artificial intelligence within an enterprise, but it is also an act of systematic introspection.  Why do we want to use AI? What will we use AI to do? Who will use AI?  What do we not want to use AI to do?  What tools are we allowed to use? What are we already doing? What advancements are likely in the future that might change our answers?

Unsurprisingly, these are many of the same types of questions companies were forced to ask themselves when developing a social media policy, or an internet policy, or a privacy policy, or a mobile device policy.  And that’s because the same kind of self-examination is necessary in order to develop guardrails (and guidelines) for any new technology within an organization.  But those past technological adoption cycles weren’t nearly as fast, weren’t nearly as powerful, and did not have nearly the same potential to be transformative.

As AI tools become increasingly omnipresent in American life, many businesses are awakening to an incredible variety of unexpected risks posed by the use of artificial intelligence. AI tools used in hiring and promotion, structuring the information that you use to decide who to hire without you even realizing it. Contracts that explicitly warrant that nothing provided under the agreement will be used to train AI, despite the fact that you may be doing that unknowingly throughout your organization. Young marketers using AI to create marketing collateral and online advertising, accidentally creating infringing works through the use of black box tools they don’t understand. AI actually being the “consumer” who experiences your branded content and makes decisions for your consumer. Deep fakes being used to scam your customers, or your employees, while pretending to be you.  AI being used to shape planning and decisions and analysis throughout the organization.  AI writing and creating things that in prior years would be proprietary, but now may no longer be protectible. Agentic AI taking control of computers, and software, or writing code that changes your data, autonomously.

An AI policy interrogates each of those possibilities, and more, and helps frame the way it is supposed to work in your enterprise, which is of particular importance when you know that those rules are likely to be broken when technology changes faster than your policy.

What Should an AI Policy Say?

An AI policy must address several critical areas for any company or firm, and then “should” address a number of others that will vary depending on the nature of your business.  First, what are the approved tools, and the governance structure. Second, what are the restrictions on confidentiality, data security, document retention, or privilege. Third, how do you deal with recording and transcription?   Fourth, how do you deal with AI generated material – what is your IP policy on the use of AI?  Finally, what is your policy on the use of AI in hiring and promotion?

But these are simply the must-have provisions that all organizations share, regardless of where they fit in a given market.  Depending on the nature of your business, you may need to deal with regulatory requirements (or, as a law firm, professional responsibility).  Perhaps you have the type of organization that needs to aggressively incorporate AI into their work, or perhaps the type that needs to keep many AI tools at arm’s length; the answers to those questions will drive many other provisions.  How will you handle training, supervision, and updates?  Are there certain permitted tasks, and other prohibited tasks, where AI usage needs to be cabined?  How will you handle monitoring, or non-compliance?

There are no one-size fits all AI policies, and efforts to try to turn them into simple templates are counterproductive.  Instead, they can help any business, or firm, deal with a unique set of issues presented by a disruptive technology, and provide a roadmap for how it can easily evolve to meet a new set of challenges ready to arrive shortly.  We may not have true artificial general intelligence quite yet, where these tools are self-aware helpmates more akin to co-workers than software, but a good AI policy is written with an eye towards a very different kind of future than the one we can clearly see today.

Darren Cahr is a partner at Scharf Banks Marmor LLC