Where to start on AI governance & why it slips
Most AI use policies are guessing at the work they are trying to govern.
The policy gets written. It gets embedded across employment agreements, code of conduct, and L&D training. And then it falls apart in practice because nobody mapped the work first.
If you are a GC, the question to answer before the policy is this:
For every meaningful process in your business, is it Human-only, AI-augmented, or AI-first?
Without that classification, your policy is generic guardrails laid over work you do not actually understand. And generic guardrails are exactly why staff drift away from the policy.
Here is how to think about the classification.
Regulatory exposure. Internal-only work is not the same as work that goes to an external client. Neither is the same as work going to the Court or a regulator. Your classification has to track where the output lands. The same drafting task can sit in three different categories depending on the audience.
Productivity. Drafting a new contract with AI sounds clever. If you already have a template, the template is faster and more accurate. AI-first is not a default position. It is a deliberate choice for the processes where AI actually beats your existing system.
Quality of output. Have you built prompt libraries, examples, and guardrails for the tasks you are augmenting? If you have, AI-augmented is realistic. If you are asking a junior to prompt from scratch every time, you are not augmenting. You are outsourcing judgement to a tool nobody has configured.
Enterprise risk tolerance. Are you using Copilot because you are a Microsoft house? Or because the data classification of the work demands an enterprise LLM with the right controls? Privileged matters, personal information, and strategic M&A do not all sit comfortably in the same environment. Tool choice is downstream of risk appetite, not upstream of it.
The development question. If you AI-first the work that builds junior judgement, where does the next generation of senior lawyers in your team come from? This is the question nobody is asking and the one your CHRO will be asking you in 18 months.
Get the classification right and the policy writes itself.
Skip it, and you end up with a document that says the right things and changes nothing.
