AI governance for mid-market companies: the minimum viable policy.

In most companies, AI adoption started before anyone wrote a rule. Employees paste customer emails, contracts, and code into whatever tool is open in their browser. Banning AI rarely works. A short, clear policy does.

The five decisions every policy needs

1. Approved tools. Name the enterprise AI platforms that are allowed, and why. Enterprise versions of ChatGPT, Copilot, Gemini, and Claude offer contractual data protections that consumer versions do not.
2. Data rules. Define what may never go into an AI tool: customer personal data, payment data, health information, unreleased financials, and trade secrets, unless the tool is approved for it.
3. Human review. Require a person to check AI output before it reaches a customer, a regulator, or a financial statement.
4. Ownership. Name an executive who owns AI decisions and a simple path for requesting new tools or use cases.
5. Training. Teach people what good use looks like, with examples from their own jobs.

Then go after the value

Governance is only half the job. The other half is finding the workflows where AI saves real time: customer service responses, finance close tasks, reporting, proposal drafting, and software development. Pick a few, measure before and after, and expand what works.

A policy that fits on two pages, backed by the right tools and a few measured wins, will do more for your company than a 40-page framework nobody reads.