Building an AI Ethics Policy That Actually Works

There’s a particular kind of document that lives in company shared drives, rarely opened, never updated, and quietly irrelevant to the people it was meant to guide. For many organizations right now, their AI ethics policy may be that document (if it even exists at all).

It’s not that the intentions aren’t good. Business leaders generally want to use AI responsibly. But somewhere between the boardroom conversation and the published PDF, the policy becomes abstract, jargon-heavy, and disconnected from how people actually work. And so the tools get adopted anyway, employees make their own calls about what’s appropriate, and the policy sits there, technically existing, practically useless.

So what does a policy that actually works look like? Here are the principles we think matter most.

Start With What Your Business Actually Does With AI

Before you can govern AI use, you need to know what AI use looks like in your organization. Not in theory, in practice.

Are your sales team using AI to draft client emails? Is finance using it to summarize reports? Are your developers leaning on it to write and review code? Before writing a single policy line, do the audit. Talk to team leads. Run a survey. You’ll likely find that AI adoption is already much further along than leadership realizes and far more varied.

A policy written without this grounding will inevitably miss the things that matter and over-regulate the things that don’t.

Define What "Ethical AI Use" Actually Means For Your Context

“Use AI responsibly” is not a policy. It’s a wish.

Responsible use means different things in different sectors. A healthcare organization using AI to support clinical decisions faces entirely different ethical stakes than a marketing agency using it to generate campaign copy. Your policy needs to reflect your context, the risks specific to your industry, your clients, and your data.

Be concrete. Instead of “exercise caution with sensitive data”, try “do not input personally identifiable client information into third-party AI tools unless the tool has been approved by IT and a data processing agreement is in place”. Specificity is what turns principles into behaviour.

Address The Real Concerns Employees Have

Most employees using AI at work are not trying to cut corners or behave unethically. They’re trying to do their jobs well or at the very least more efficiently, and they’re often genuinely unsure what the rules are.

The questions they’re actually asking themselves include:

Can I use AI to help write this report, or does that count as misrepresentation?
If I paste this client data into an AI tool, where does it go?
Who is responsible if AI-generated content turns out to be wrong?

A good ethics policy answers these questions directly. If it doesn’t, people will fill the gaps themselves and they’ll fill them inconsistently.

Assign Clear Ownership And Accountability

Ethical AI use doesn’t happen through documents alone. It happens through people.

Your policy should name who is responsible for what. Who approves new AI tools before they’re adopted? Who do employees go to with concerns? Who reviews the policy and how often? If the answer to any of these is “everyone” or “unclear”, that’s your first problem to solve.

In larger organizations, this might mean establishing an AI governance committee with representatives from legal, IT, HR, and operations. In smaller ones, it might simply mean designating one senior leader as the point person. What matters is that accountability is real, not notional.

Make Compliance The Path Of Least Resistance

Policies fail when following them is harder than ignoring them.

If your ethics policy requires employees to go through a lengthy approval process every time they want to try a new AI feature, they’ll find workarounds. If the approved tools are clunky and the unapproved ones are excellent, people will use the unapproved ones.

Think about how to make doing the right thing easy. Pre-approve a suite of tools that meet your security and ethics standards. Create simple, clear guidance documents for common use cases. Build ethics check-ins into existing workflows rather than creating parallel processes.

Plan For Iteration, Not Perfection

The AI landscape is changing faster than any policy can keep up with. Whatever you publish today will need updating within months, not years.

Build that into the policy itself. Set a review cadence, quarterly or bi-annual depending on your pace of AI adoption, and stick to it. Create a lightweight process for flagging new ethical questions as they arise, so the policy evolves in response to real experience rather than just in response to crises.

The goal is not a definitive document. It’s a living framework that keeps pace with your organization and the technology shaping it.

Know Where AI Shouldn't Replace People

One of the most important, and often overlooked, questions an AI ethics policy should address is not just how AI is used, but where it shouldn’t be used at all.

AI-generated imagery is a prime example. Tools that produce marketing visuals, illustrations, and photography-style images at the click of a button are impressive, but using them to replace the artists, photographers, and creative professionals who would otherwise do that work is an ethical choice, not just an operational one. It devalues skilled creative labour, contributes to the erosion of livelihoods, and often produces work that lacks the authenticity and intentionality that human creativity brings. We believe that commissioning real artists, photographers, and marketing professionals to handle visual and creative work is not just the more ethical path, it’s also the one that produces better, more meaningful results for your brand.

This principle extends beyond imagery. When AI is used to automate tasks that real employees could perform, organizations should ask themselves whether efficiency gains justify the human cost. A strong ethics policy doesn’t shy away from this question. It sets clear expectations about where AI is a tool that supports people, and where it is not a substitute for them.

AI Is A Tool, Not An Authority

It’s easy to forget, when AI produces something fluent and confident, that it can still be wrong. Factually incorrect. Legally problematic. Culturally tone-deaf. Subtly biased. The outputs look polished, and that polish can breed a dangerous level of trust.

AI is a tool for humans to use, not a decision-maker to defer to. Yet increasingly, organizations are publishing AI-generated content, sending AI-drafted communications, and pushing AI-assisted work to production with little or no human review. That’s not efficiency. That’s a risk that hasn’t been properly accounted for.

This is why every AI ethics policy should include an explicit human review requirement at least until these tools can get to a point that they can be trusted with the work you give it. Here’s an example of how that might read in your own documentation:

Human Review Policy: AI-Generated Content
All content, copy, code, analysis, imagery, or documentation that has been produced or materially assisted by an AI tool must be reviewed and approved by a qualified human before it is published, shared externally, or deployed to a production environment. The reviewing individual is responsible for verifying factual accuracy, appropriate tone, legal compliance, and alignment with organizational values. AI output should be treated as a first draft, not a final product.

A clause like this costs nothing to include and protects against a great deal. More importantly, it establishes a cultural norm: that AI augments human judgement, it doesn’t replace it.

Lead With Intention, Not Just Compliance

An AI ethics policy that works is not about protecting the organization from liability, though it does that too. It’s about equipping your people to make good decisions in ambiguous situations, and building the kind of culture where they want to. That means being clear about where AI should and shouldn’t be used, protecting the value of human creative work, and ensuring that a real person is always accountable for what goes out the door.

That requires clarity over comprehensiveness, specificity over aspiration, and ongoing conversation over a one-time document. Get those things right, and your policy might just be the one that people actually read and actually follow.

Additional Reading

Useful Resources

Trust First AI Policy Maker