Short answer
A shadow AI policy should acknowledge current use, set clear data rules, name approved tools, prohibit sensitive use in unapproved systems and give staff a simple route to ask for approval.
Policy purpose
The policy should not simply say no. A useful version explains that the firm wants to use AI responsibly, but cannot allow client data, confidential documents, regulated advice, legal privilege, credentials or commercially sensitive information to be placed into unapproved tools. The tone matters: staff should see the policy as a safe route forward, not as a trap.
Short template wording
Staff may use approved AI tools for approved purposes. Staff must not enter client-identifiable information, confidential documents, regulated advice, legal material, HR information, credentials, contracts or commercially sensitive data into public or unapproved AI tools. Any new AI use that touches client work, firm data or operational decisions must be approved before use.
Permitted low-risk use
A small firm can usually allow low-risk uses such as summarising public information, drafting non-client internal notes, creating first drafts from non-confidential inputs, or learning how tools work. The policy should still tell staff to check outputs, avoid over-reliance and never present AI output as verified professional judgement without review.
Approval route for real use cases
The policy becomes useful when staff know how to ask for permission. Create a simple route: describe the workflow, tool, data, users, expected output, review point and business owner. Then decide whether the use is allowed, allowed with controls, needs more review or is not suitable. This turns shadow AI into a managed pipeline of real opportunities.
Rollout plan
Introduce the policy with a short explanation of why it exists, examples of allowed and prohibited use, and a named contact for questions. Managers should ask teams where AI is already helping and where they feel exposed. The aim is to bring useful behaviour into the open, stop risky data use and identify workflows worth formal support.
Keep it alive
Review the policy when new tools are approved, supplier terms change, client data access expands or a workflow moves from experimentation into regular use. A policy that is never updated quickly becomes irrelevant. A lightweight quarterly review is often enough during early adoption.