How do you replace an AI ban with rules staff will follow?
In Microsoft and LinkedIn’s 2024 Work Trend Index, 78% of AI users said they bring their own AI tools to work. Many employers answer with a ban, and a ban without an approved alternative moves AI use out of sight. When Italy blocked ChatGPT from March to 28 April 2023, a working paper found that use of tools to get around the block, such as Tor, rose.
This course gives leaders the documents that replace a ban: an AI use policy, an approved tool list with a data rule per tool, and a table of who decides what. You draft all 3 on your own organisation’s tools, data rules and tasks during the day.
After this course
- Can you explain why a ban without an approved alternative moves AI use onto personal accounts?
- Can you draft an AI use policy on your organisation's own tools, data rules and staff tasks?
- Can you build an approved tool list with one data rule and one named owner per tool?
- Can you set who approves a new AI tool, a new use case and an exception to the rules?
- Can you decide per task whether AI may only suggest or may also act, and record the reason?
- Can you keep AI literacy records for Article 4 and measure adoption with numbers tied to decisions?
Skills you practise
- AI policy drafting
- Tool approval
- Data rules per tool
- Decision rights
- Autonomy levels
- AI literacy records
- Adoption measurement
Course structure
The course is 1 day of 6 teaching hours, in 2 blocks of 3 hours with a lunch break. Online, it runs as 2 live sessions of 3 hours on the same day, not recorded.
The morning opens with why bans fail. Samsung banned generative AI on company devices from 1 May 2023, after engineers pasted internal source code into ChatGPT. In Cisco’s 2024 privacy benchmark, 27% of organisations had banned generative AI at least for a time, and 48% of respondents admitted entering non-public company information into such tools. Participants then list what staff in their own organisation already use and write a no-blame survey to send in the week after. The rest of the morning goes to the AI use policy, drafted clause by clause on your data rules and 5 typical staff tasks.
The afternoon starts with the approved tool list. For each tool the group records the account type, whether a processor contract is in place, what the tool can read beyond the prompt, and the highest data class it may take. Next come decision rights: who approves a new tool, a new use case and an exception. The group also sets which tasks AI may only suggest on and which it may act on.
The last hour covers the AI literacy records that support your Article 4 duty, what makes staff hide AI use, and 3 to 5 adoption measures tied to decisions.
About two thirds of the time is drafting and testing on your own material, in your organisation’s approved AI tool.
1Why bans fail without an approved alternative45 min
- Italy's 2023 ChatGPT block and the workarounds
- Samsung's 2023 ban after a source code leak
- What staff do when the only answer is no
- Choosing the approved alternative first
A ban with no approved alternative can lead staff to personal accounts and workarounds. Put the approved alternative in the same rule as the restriction.
Caution. When Italy blocked ChatGPT from March to 28 April 2023, a working paper found that use of tools to get around blocks, such as Tor, rose significantly.
You leave with: A list of AI uses the organisation will allow, restrict or stop, with the approved alternative for each restricted use.
2Finding the shadow AI already in use45 min
- Personal accounts used for work
- What the 2024 surveys found
- A no-blame inventory of tools and tasks
- Questions that get honest answers
Chat assistants reply in a friendly, human tone, and many staff share confidential work with them as they would with a colleague. A no-blame survey finds out what they type in.
Caution. In the 2024 Work Trend Index, 78% of AI users said they bring their own AI tools to work, so assume personal accounts are already in use.
You leave with: A no-blame AI use survey ready to send, and a first list of tools staff are known to use.
3Drafting the AI use policy on your own data90 min
- What the policy must answer for staff
- Permitted, restricted and prohibited uses
- Who checks AI output and when
- Telling clients when AI was used
- Testing each clause on real tasks
A policy clause drafted with AI is a proposal until someone has tested it on a real task. The policy says who checks each type of AI output, and when.
Caution. Draft only in a tool your organisation has approved for internal documents, and remove personal data from the task examples first.
You leave with: A first full draft of the AI use policy, written on the organisation's own rules and tasks.
4The approved tool list and a data rule per tool60 min
- Account type and processor contracts
- Whether the provider trains on your inputs
- Tools that read email, files and web pages
- One data rule per tool
- Requests to add a new tool
A model can be steered by instructions hidden in the text it reads, and it can leak what it has access to. A tool that reads email, files or web pages needs a stricter data rule than one that sees only what staff type.
Caution. Where a provider processes prompts for your organisation, GDPR Article 28 requires a processor contract, and consumer accounts often lack one.
You leave with: The approved tool list: each tool with its account type, contract position, reach, data class and owner.
5Decision rights: suggest, draft or act60 min
- Who approves a new tool, use case or exception
- Suggest, draft, act: levels of AI autonomy
- Tasks where AI may only suggest
- Escalation and sign-off times
For each task, decide whether the AI may suggest, draft or act, and who signs off at each level. Move a task up a level only after its checks have passed on real work.
Caution. ESMA expects investment firms to control staff use of third-party AI tools whether or not management approved them, so the table must also cover tools nobody signed off.
You leave with: A decision-rights table and an autonomy level (suggest, draft or act) for each approved use case.
6AI literacy records under Article 430 min
- What Article 4 asks of deployers after the July 2026 amendment
- What the AI Act does not require
- Records to keep: who, which tools, which training
- Supervision from August 2026
Staff who know how a model produces text are better placed to spot its errors in their own work. A literacy record shows which tasks and tools each person was trained on.
Caution. The AI Act does not require a certificate; the European Commission says internal records of training are enough, and national market surveillance authorities supervise Article 4 from August 2026.
You leave with: An AI literacy record template for the organisation, with this course entered for each participant.
7Culture, behaviour and adoption measures30 min
- What makes staff hide AI use
- Leaders using the approved tools openly
- Measures tied to tasks, errors and rework
- Measures to drop: logins and prompt counts
When leaders use the approved tools in the open, staff find it easier to say how they use AI. Measure what AI changes in tasks, errors and rework.
Caution. Count what AI changes in the work, such as rework and errors caught, because login and prompt counts can rise with no change in results.
You leave with: 3 to 5 adoption measures, each tied to a decision, and a note on how leaders will use the approved tools in the open.
Why bans fail without an approved alternative
Name the approved alternative in the same clause as the restriction.
Write a policy line banning AI chatbots for staff.
Draft one policy clause for staff, under 60 words. Say which AI tool staff may use for drafting and summarising, which data they may put into it, and which uses need approval from the AI lead. Write in plain English for an internal memo and end with where to ask questions.
Finding the shadow AI already in use
Ask staff about tasks and tools, and state that answers carry no blame.
Write a survey asking staff if they use AI.
Write a staff survey of 6 questions about AI use at work. Ask which tasks people use AI for, which tools and accounts they use, what kinds of data they have pasted in, and what would make them switch to an approved tool. Open with 2 sentences saying answers are anonymous and past use will not lead to discipline. Use multiple choice for 5 questions and free text for the last one.
Drafting the AI use policy on your own data
Give the assistant your rules and tasks, then ask for one clause at a time.
Write an AI policy for our company.
Using the 3 documents below (our data classification rules, our list of AI tools in use, and 5 typical staff tasks), draft the clause of our AI use policy on checking AI output. Say who checks, what they check against, and what happens when an error is found. Under 150 words, numbered points, plain English. After the clause, list each question you could not answer from the documents. [documents]
The approved tool list and a data rule per tool
State for each tool what data it may receive and what it can reach.
Which AI tools are safe to use?
Build a table of the 6 AI tools listed below. Columns: tool, account type (personal or company contract), processor agreement in place (yes, no, unknown), what the tool can read beyond the prompt (email, files, web), highest data class allowed (public, internal, confidential, personal), owner. Fill it only from the contract notes I paste and write 'unknown' where the notes are silent. [tool list] [contract notes]
Decision rights: suggest, draft or act
Ask for a table that names one decider per decision.
Who should be responsible for AI here?
Draft a decision-rights table for AI use in our organisation. Rows: approve a new AI tool, approve a new use case, grant an exception to the data rules, raise a task from 'AI suggests' to 'AI acts', stop a tool after an incident. Columns: who proposes, who decides, who is consulted, who is informed, maximum days to decide. Use only the roles listed below. [roles]
AI literacy records under Article 4
Specify the fields, the format and one example row.
Make an AI training register.
Create a template for our AI literacy record. Fields: name, role, AI tools used, training received (course, date, hours), topics covered, main AI tasks in the role, next review date. Format: a table with one example row filled in with made-up data. Under the table, write 3 lines on how often to review the record.
Culture, behaviour and adoption measures
Name the decision each measure will inform before you collect it.
What KPIs should we track for AI adoption?
Propose 5 measures of AI adoption for a team of 12 that handles customer complaints. For each measure give what it counts, where the data comes from, which decision it informs, and how someone could game it. Put them in a table, ranked from hardest to game to easiest.
You leave with 3 documents drafted on your organisation’s own data: the AI use policy, the approved tool list with a data rule per tool, and the decision-rights table. If staff drafted a tool list in Shadow AI and Safe AI Use, this day turns that draft into the list the organisation adopts.
In the week after the course, the policy goes to the owners named in the decision-rights table for sign-off. The tool list goes to IT and procurement to close every gap marked “unknown”, and the survey goes to staff. Plan a review of all 3 documents once the survey results are in. Each participant also receives an attendance record for your AI literacy file.
- Teaching time
- 6 hours on 1 day, in 2 blocks of 3 hours with a lunch break.
- Before the day
- None; participants bring their organisation's current AI rules, if any, and a list of AI tools staff are known to use.
- After the day
- An AI use policy and an approved tool list, drafted on the organisation's own data during the course, plus a decision-rights table.
Completion
You complete the course by working through each exercise on your own tasks. There is no exam and no grade. Each participant receives an attendance record for your AI literacy file (not a certificate).
Who is this course for?
Executives who sponsor AI use, programme and innovation managers who run it, and HR and risk leads who answer for it. The course fits organisations where staff use AI without clear rules, where a ban is in place and staff work around it, or where a tool has been bought and nobody owns the rules.
Bring the people who will own the policy. A useful group has a sponsor, a programme lead, and one person each from HR, risk or privacy, and IT, so every clause has an owner in the room.
Choose Managing Teams That Work With AI if your task is the routines inside one team. Choose AI Strategy and Change for Decision-Makers if the board first needs to set direction and apply sector rules. Choose Shadow AI and Safe AI Use to train all staff on the rules once they exist.
In the Manager path, this course is step 2 of 3, after AI Literacy and the AI Act. Next: Managing Teams That Work With AI.
- Level
- Intermediate
- Before you start
- None; participants bring their organisation's current AI rules, if any, and a list of AI tools staff are known to use.
- Group
- 1 to 12 people, online, live or at your office
This course is right for you if you
- sponsor, run or answer for AI use in your organisation
- face a ban that staff work around, or no rules at all
- need a policy and a tool list that people will follow
Unsure whether it fits? Ask us. We reply within 1 working day.
Practical information
- 1 day, 6 teaching hours, with a lunch break
- Online: live in 2 sessions of 3 hours on one day, not recorded; times agreed in the intake call
- At your office: 09:30 to 16:30; you provide a room, a screen and internet access
- In English, in the AI tool your organisation has approved
- Taught live by a practitioner with more than 15 years of commercial and technical leadership in software and data companies across Europe and Asia-Pacific, including maritime, energy and fintech.
- Attendance record for your AI literacy file
- Online, live: 1 day in 2 live sessions of 3 hours, not recorded. Book it as a private day for your team of 1 to 12 people, on your own Teams, Zoom or Meet.
- At your office: 1 day (6 teaching hours) for 1 to 12 people, travel within the Netherlands included.
Dates and booking
Choose the format, an open weekday in the calendar and the number of participants, then reserve on this page.
The calendar and booking form load with JavaScript. Without it, ask us for a date on WhatsApp, by phone on +31 6 20 51 73 96 or at advisory@ai-business.school.
Investment
| Item | Online, live | At your office |
|---|---|---|
| Price | €399 per person | €2,900 for the day, for your group |
| Including 21% Dutch VAT | €482.79 per person | €3,509 |
| The training day | Included | Included |
| A 30-minute intake call on your tools and data rules | Included | Included |
| Course materials and templates | Included | Included |
| Attendance record for your AI literacy file | Included | Included |
| Travel within the Netherlands | Not needed | Included |
| Group | 1 to 12 people | 1 to 12 people |
Prices exclude VAT. Online, live, you pay per participant. At your office, one price covers your whole group, from 1 to 12 people; for a larger group, book a second day. You reserve on this page; the payment details appear when you do.
Questions
What should an AI use policy for employees include?
Which tools staff may use, which data each tool may take, who checks AI output, and who approves new tools and uses. In this course you draft each part on your own organisation's tools and tasks.
Should we ban ChatGPT and other AI chatbots at work?
A ban without an approved alternative tends to move use onto personal accounts. In the 2024 Work Trend Index, 78% of AI users said they bring their own tools, and Italy's 2023 block saw use of workaround tools rise. The course helps you decide which uses to allow, restrict or stop, and which approved tool to offer.
Does this course meet the EU AI Act AI literacy requirement?
It supports your Article 4 AI literacy duty. The AI Act does not require a certificate; you keep internal records, and each participant gets an attendance record for your AI literacy file.
Can we use our existing policies in the course?
Yes. Bring your current AI rules, IT and privacy policies and a list of the AI tools staff are known to use. The drafts are written on those documents, so they fit your organisation from the start.
Who in our organisation should attend AI governance training?
The people who will own the policy: an executive sponsor, the programme or innovation lead, and someone from HR, risk or privacy, and IT. The group is capped at 12 because the policy is drafted together.
Last reviewed 21 October 2026.
Related courses
AI Literacy and the AI Act
Explain what the EU AI Act asks of your organisation and keep the records for your AI literacy file.
€399 per person online · €2,900 a day at your office, up to 15 people
Shadow AI and Safe AI Use
Use AI at work without leaking data or falling for deepfake scams, and leave with the input for your AI policy.
€399 per person online · €2,900 a day at your office, up to 15 people
Managing Teams That Work With AI
Decide which team tasks AI does, assists or stays away from, set who checks what, and measure the results.
€399 per person online · €2,900 a day at your office, up to 12 people