A ban-first AI policy creates more shadow AI, not less. The best AI policy is a change tool: it starts from what people already do, and says what is allowed before it says what isn't.
Short answer: in most organisations, yes, employees can use AI at work, but only in the ways the employer has decided. Without a policy, every employee makes their own call on which tools to use and what to paste into them. That is where the risk sits.
Why employees are asking this question
"Can I use ChatGPT at work?" is a question employees ask, not leadership teams. That matters. People already use ChatGPT, Copilot and other tools, often on personal phones and without telling anyone. They search because they are unsure whether they are doing something wrong.
Most AI policies answer with a list: don't paste personal data, use approved tools only, always check the output. All reasonable. But a list of prohibitions does not solve the underlying problem, which is that employees have a need the organisation has not met.
Common AI policy mistakes
1. IT and legal write it without the business. The result is a document about risk, not about work. Nobody reads it, or they read it as "don't use AI".
2. Bans without alternatives. Ban ChatGPT without offering an approved tool that handles the same tasks, and usage simply moves out of sight.
3. It launches as an email. A policy that a line manager never walks through, using the team's own examples, changes no behaviour.
4. It is never updated. AI tools change every quarter. Last year's policy is often already wrong.
How to write an AI policy people actually follow
Step 1: Find out what is already happening
Run a short anonymous survey. Which AI tools do you use? For what tasks? What would you use AI for if you were allowed? Anonymity matters, or you only get the answers people think you want.
Step 2: Start with what is allowed
Write the policy in three tiers:
Allowed: approved tools and tasks (first drafts, summarising your own documents, brainstorming).
Allowed with conditions: for example, customer data only in the approved enterprise tool, and a human review before anything reaches a customer.
Not allowed: for example, personal or confidential data in public tools, or AI alone making decisions about employees.
When "allowed" comes first, people read the policy as an invitation rather than a warning.
Step 3: Launch an approved alternative at the same time
A policy without a tool that covers the most common tasks will be bypassed. Launch them together.
Step 4: Let managers own the walkthrough
Give every manager a one-page brief and ask them to cover the policy in a team meeting, with two or three examples from the team's own work. That is where a policy becomes real.
Step 5: Connect it to the EU AI Act
Since 2 February 2025, Article 4 of the EU AI Act has applied: providers and deployers of AI systems must take measures to support the development of AI literacy among their staff (EUR-Lex, Regulation (EU) 2024/1689). A policy that explains why the rules exist, backed by training, is a natural part of that work.
Step 6: Involve employee representatives
In the Nordics and much of Europe, introducing tools that change work or process employee data can trigger consultation duties. In Sweden, for example, employers may need to negotiate under section 11 of the Co-determination Act (MBL) before deciding (Unionen). Bring unions or works councils in early. It lends the policy legitimacy.
Step 7: Set a review date
Write into the policy when it will be reviewed, for example every quarter in the first year.
AI policy checklist
Purpose: why we use AI and what we want to achieve
Approved tools and who owns them
Three tiers: allowed, allowed with conditions, not allowed
Data rules: what may and may not be entered
Human review and accountability for outputs
How to report mistakes or incidents, without punishment the first time
Where to get support and training
Next review date
The policy is the start, not the finish
At Lyon AM our view is that roughly 70% of a successful AI programme is about people, leadership and ways of working, not technology. That is consistent with Prosci's study of 1,107 professionals, which found 63% of AI implementation challenges were human factors and only 16% technical (Prosci). The policy is employees' first evidence of whether leadership is serious about AI, or just protecting itself.
Frequently asked questions
Can an employer ban ChatGPT at work? Yes. The employer decides which tools may be used for work. But a ban with no approved alternative usually pushes usage underground.
Is a company legally required to have an AI policy? There is no general legal requirement for a document called an AI policy. But the EU AI Act requires organisations using AI to take measures to support the development of AI literacy among staff, and GDPR still applies. A policy is the simplest way to show how you do that.
What is shadow AI? Shadow AI is employees' use of AI tools the employer has not approved or does not know about, usually because approved tools are missing or not good enough.
How often should an AI policy be updated? At least yearly, and ideally quarterly in the first year, because tools and usage change fast.
Next step
Want to know where your organisation stands? Take the Lyon AM AI diagnostic. It shows both how much AI is actually being used and how ready your foundations are. Or contact us to talk about your AI policy and how to make it stick.
