An AI policy that only tells employees what they cannot do may create the very risk it was written to prevent.

By Sukhi Dhillon Alberga | BLS Consulting

An employee needs to summarize a lengthy document before a management meeting. The organization has an AI policy, but it prohibits unapproved applications and provides no practical alternative.

The employee has two choices: complete the work manually or use an AI service without telling anyone.

Some employees will follow the policy. Others may decide that meeting the deadline matters more than complying with a rule they consider impractical.

The organization believes it has restricted AI use. In reality, it may have made that use harder to detect.

A policy with no sanctioned alternative is a policy against visibility. Use does not necessarily stop; it moves out of sight.

The difference between an ineffective AI policy and a usable one becomes clear when comparing two versions of the same employee guidance.

Version One: The Policy That Exists on Paper

Consider this fictional example of a typical restrictive policy:

Employee Use of Artificial Intelligence

Employees must not use unauthorized AI applications for company business. Confidential information must not be entered into AI systems. Only applications approved by IT may be used. Violations may result in disciplinary action.

The language is brief, direct and easy to distribute. It also leaves important questions unanswered.

Employees do not know whether they can use AI for ordinary tasks such as preparing meeting agendas, improving non-confidential writing or organizing publicly available information.

They cannot determine which uses require approval or how to request it. The policy may refer to prohibited applications without identifying a practical, approved route for completing legitimate work.

For a mid-sized or large Canadian organization, these gaps matter.

Employees across finance, HR, operations and customer service face different information-handling responsibilities. A blanket restriction does not help them distinguish low-risk assistance from activities involving confidential records, personal information or consequential decisions.

The result can be inconsistent behaviour.

Some employees avoid AI entirely. Others interpret the restrictions differently. Some may use personal accounts or unapproved services because they believe the policy prevents them from doing their work efficiently.

Management then loses visibility into where information is going, which activities involve AI and whether appropriate checks are being performed.

A prohibition may still be necessary for particular activities. But prohibition alone is not an operating framework.

Version Two: The Policy Employees Can Actually Use

Now consider a more practical version of the same section:

Employee Use of Artificial Intelligence

Permitted use: Employees may use organization-approved AI capabilities for specified low-risk activities, including drafting general internal communications, organizing non-sensitive information and preparing preliminary materials. Employees remain responsible for reviewing accuracy and appropriateness.

Prohibited use: Employees must not enter confidential client information, employee personal information or other restricted data into AI systems unless that specific use has been reviewed and expressly authorized. AI output must not be presented as verified fact without appropriate checking.

Use requiring prior review: AI involving sensitive information, customer-facing communications, employment decisions, financial reporting or other material business decisions requires approval through the organization’s established review process.

How to obtain approval: Employees should contact the designated internal AI policy owner through the published approval channel. That owner will confirm permitted options, assess proposed uses with relevant teams and communicate the decision.

Reporting concerns: Employees must report suspected information exposure, significant errors or unintended AI use through the established incident-reporting process.

This version is not a complete policy. It illustrates how employee guidance can move from a general warning to practical instructions.

The key difference is that employees can understand what is allowed, what is restricted and where to obtain an answer.

It also gives management a way to identify legitimate business needs that the current policy does not address.

The Difference Is Operational, Not Cosmetic

A usable AI policy for employees must reflect how work is actually performed.

That requires input from HR, legal, compliance, IT and business leaders. It also requires someone to own the policy, maintain the approved-use guidance and respond when employees encounter situations that are not covered.

Canadian organizations must consider applicable privacy obligations when personal information is collected, used or disclosed. The Office of the Privacy Commissioner of Canada’s principles for responsible generative AI emphasize accountability, including organizational responsibility for how generative AI is used.

That responsibility cannot be discharged simply by distributing a document and assuming employees will comply.

Training matters just as much as wording. Employees need examples relevant to their work, an understandable approval process and confidence that asking about an AI use will produce a timely response.

The objective is not unrestricted adoption. It is controlled, visible use with clear boundaries.

This is also why AI governance belongs within broader risk management and compliance, rather than being treated solely as an IT issue.

An effective policy should help management see where AI is being used, identify emerging risks and make informed decisions about appropriate uses.

A restrictive policy can create the appearance of control. A usable policy creates the conditions for actual control.

Make the Policy Work in Practice

BLS Consulting helps organizations assess whether their AI policies, approval processes and employee training reflect how work is actually performed. A policy and training review can identify gaps, clarify acceptable use and strengthen oversight without creating unnecessary barriers to legitimate business activities.