VOOZH about

URL: https://thenewstack.io/how-to-create-an-effective-ai-usage-policy/

⇱ How To Create an AI Use Policy - The New Stack


TNS
SUBSCRIBE
Join our community of software engineering leaders and aspirational developers. Always stay in-the-know by getting the most important news and exclusive content delivered fresh to your inbox to learn more about at-scale software development.
REQUIRED
It seems that you've previously unsubscribed from our newsletter in the past. Click the button below to open the re-subscribe form in a new tab. When you're done, simply close that tab and continue with this form to complete your subscription.
The New Stack does not sell your information or share it with unaffiliated third parties. By continuing, you agree to our Terms of Use and Privacy Policy.
Welcome and thank you for joining The New Stack community!
Please answer a few simple questions to help us deliver the news and resources you are interested in.
REQUIRED
REQUIRED
REQUIRED
REQUIRED
REQUIRED
Great to meet you!
Tell us a bit about your job so we can cover the topics you find most relevant.
REQUIRED
REQUIRED
REQUIRED
REQUIRED
REQUIRED
Welcome!

We’re so glad you’re here. You can expect all the best TNS content to arrive Monday through Friday to keep you on top of the news and at the top of your game.

What’s next?

Check your inbox for a confirmation email where you can adjust your preferences and even join additional groups.

Follow TNS on your favorite social media networks.

Become a TNS follower on LinkedIn.

Check out the latest featured and trending stories while you wait for your first TNS newsletter.

PREV
1 of 2
NEXT
VOXPOP
As a JavaScript developer, what non-React tools do you use most often?
Angular
0%
Astro
0%
Svelte
0%
Vue.js
0%
Other
0%
I only use React
0%
I don't use JavaScript
0%
Thanks for your opinion! Subscribe below to get the final results, published exclusively in our TNS Update newsletter:
NEW! Try Stackie AI
From clobbered drafts to real-time sync
Apr 14th 2026 10:00am, by David Moore
TypeScript 6.0 RC arrives as a bridge to a faster future
Mar 14th 2026 9:00am, by Darryl K. Taft
Mastra empowers web devs to build AI agents in TypeScript
Jan 28th 2026 11:00am, by Loraine Lawson
2025-12-09 09:00:29
How To Create an AI Use Policy
sponsor-red-hat,sponsored-ebook-custom,
AI / AI Operations / Compliance

How To Create an AI Use Policy

An AI usage policy is crucial for safe innovation. Learn the key steps to create one in this excerpt from our new ebook.
Dec 9th, 2025 9:00am by Jennifer Riggins
👁 Featued image for: How To Create an AI Use Policy
Featured image by Pla2na on Shutterstock.
Red Hat sponsored this post.

This is an excerpt from Chapter 2 of “AI for the Enterprise: The Playbook for Developing and Scaling Your AI Strategy,” a new ebook by acclaimed tech journalist Jennifer Riggins and sponsored by Red Hat and Intel.

From the advantages of using the “two-speed” AI investment model, to measuring the real impact of AI, this free book, now available for download, helps enterprise leaders create an AI strategy to unlock productivity gains, solve previously impossible problems and gain a true competitive edge.


Most organizations needed an AI usage policy yesterday. Yet only about half have them.

“How many products have had AI shoved in there while completely ignoring the primary pain points of their products and their platforms?” asked Hannah Foxwell, founder of AI for the Rest of Us. “Your AI strategy needs to be grounded in the business today, not in some fictitious version of the business tomorrow.”

To develop your AI policy, establish a cross-functional, cross-organizational AI enablement team — perhaps seated in the new CAIO office.

The International Organization for Standardization’s AI standards are a good place to start considering your AI policy:

  • ISO/IEC 42001 – AI governance and risk management: Establishes accountability and oversight, setting up risk management protocols to identify, access and mitigate potential risks and impacts.
  • ISO 27001 – Information security: Recommends tooling that vets across people, processes and technology. This includes a privacy management extension.
  • ISO 37301 – Compliance and ethical culture: Defines requirements for compliance management systems, as well as guidelines to nurture a culture of integrity, honesty and fairness in AI usage.

The European Union’s AI Act offers another good way to classify risk around AI tooling:

  • Unacceptable AI: Includes scraping the internet or security cameras to build facial recognition databases.
  • High-risk AI: Includes any AI for critical infrastructure and utilities, education and employment management.
  • General-purpose AI models: For AI systems that are transparent by default, which allows users to make informed decisions.

This categorization may vary for different parts of your business, depending on their levels of risk acceptance or avoidance.

It’s also wise to give everyone in your organization a refresher in local and international data privacy regulations, like the EU’s GDPR and the California Privacy Rights Act (CPRA). Generative AI (GenAI) tools’ ease of use and adoption have already led to inadvertent data leakage — you don’t want to be next.

Communicate Your AI Policy

Once your AI enablement team agrees on an AI usage policy, make sure you communicate it with all stakeholders inside and outside the organization.

Grammarly has been using AI in its product for the last 15 years, and its User Trust Center has become an industry standard for clear AI communication. It breaks the risks down into four areas:

  • Privacy
  • Security
  • Compliance
  • Responsible AI

“Managers and leaders are going through this learning journey alongside their teams, so you can’t look to your manager for concrete advice,” Foxwell said. “A centralized enablement team or external training partner is a good way to go if you want to get consistent messaging.”

Don’t forget that your AI strategy must also factor the SaaS products you are already using. If they’ve injected some sort of AI into the product, has your company vetted it for compliance?

Since these risks and use cases vary by domain, you can’t have one policy to rule them all. Consider some overarching data and security rules, but then allow subject matter and domain experts to weigh in on department-specific aspects. And ground any policies in examples based by domain or department.

As you create this AI usage policy, just remember to “translate” it from legalese to lay terms so that all employees understand. This is a good use case for GenAI — so long as you have a human reviewer in the loop.


To read more, download “AI for the Enterprise: The Playbook for Developing and Scaling Your AI Strategy” today!

👁 "AI for the Enterprise" ebook cover

Red Hat OpenShift is for innovation without limitation. Bring big ideas to life with the hybrid cloud platform open to any app, team, or infrastructure.
Learn More
The latest from Red Hat
TRENDING STORIES
Jennifer Riggins is a tech storyteller and journalist, event and panel host. She bridges the gap between business, culture and technology, with her work grounded in the developer experience. She has been a working writer since 2003, and is based...
Read more from Jennifer Riggins
Red Hat sponsored this post.
SHARE THIS STORY
TRENDING STORIES
SHARE THIS STORY
TRENDING STORIES
TNS DAILY NEWSLETTER Receive a free roundup of the most recent TNS articles in your inbox each day.
The New Stack does not sell your information or share it with unaffiliated third parties. By continuing, you agree to our Terms of Use and Privacy Policy.