Write the AI policy before you run the pilot
Most AI programs stall at the point where legal, risk, and engineering meet for the first time. That meeting should happen in week one.
The usual sequence is a pilot first, a policy later. A team finds a tool, gets a result worth showing, and then discovers that nobody can say whether the data it touched was allowed to leave the building. The pilot does not fail on technical grounds. It fails because the question of permission arrives after the work.
Reversing the order costs less than it appears to. A usable first policy is short: what data may be sent to which class of system, who approves an exception, what gets logged, and who reviews the log. That document can be written in a week, and it makes the next twenty pilots faster rather than slower.
What a first policy has to answer
- Data classes and where each one may go. Public, internal, client-confidential, regulated — and the systems approved for each.
- A named approver for exceptions, with a response time. Ambiguity here is what sends people to their personal accounts.
- A record of use. What was asked, by which system, against which data — enough to answer a regulator or a client without a forensic exercise.
- A review cadence. The tools change quarterly; a policy written once and filed is a liability.
Speed should never outrun trust. In regulated industries the second one is the asset.
The adoption problem is the same problem
Teams do not avoid AI tools because they doubt the technology. They avoid them because the rules are unclear and the downside of guessing wrong lands on the individual. Clear boundaries raise usage. People move faster inside a fence they can see.
In a first engagement we typically deliver the policy, an approved-systems list, and an exception path within two weeks — then let pilots run against it.
Where to start this week
Inventory what is already in use, including the unsanctioned tools. Classify your data. Name the approver. Publish the draft with a review date on it. A policy that is eighty percent right and visible beats a complete one that is still in review.