IT STRATEGY<\/p>\n
I’ve reviewed a lot of company AI policies over the last year. Almost all of them have the same problem: they were written for a technology that no longer exists.<\/strong><\/p>\n The AI landscape of 2023, when most enterprise policies were drafted, was largely about chatbots and content generation. The policies reflect that \u2014 they address plagiarism risks, data input concerns, and output quality checking. Sensible for the time.<\/p>\n But 2026 is a fundamentally different environment, and most policies haven’t kept up.<\/p>\n Agentic AI \u2014 systems that take autonomous actions across your infrastructure \u2014 didn’t feature in most early policies because it barely existed. Now it’s being deployed in sales, finance, IT, and HR workflows. The governance questions are completely different: who authorises what actions, how do you audit what an agent did, what’s the escalation path when it does something unexpected?<\/p>\n Shadow AI has also exploded. Employees are using personal accounts on commercial AI platforms to process work data, bypassing every control your policy assumes is in place. A 2023 policy that says “use approved tools only” is not a governance framework \u2014 it’s a wishful thinking document.<\/p>\n “A policy that says ‘use approved tools only’ is not a governance framework. It’s a wishful thinking document.”<\/p><\/blockquote>\n At minimum, your AI policy needs to address: data classification and what can go where, agentic system approval and audit requirements, employee personal-use boundaries, output verification requirements by risk level, and incident response procedures specific to AI failures.<\/p>\n If yours doesn’t cover all of those, you have a gap. And gaps in AI governance aren’t theoretical \u2014 they’re regulatory and reputational risks that are already being realised at organisations that moved fast and thought about governance later.<\/p>\n Tags: Artificial Intelligence \u2022 Opinion \u2022 Technology & Society \u2022 192.168.1.22\/<\/p>\n","protected":false},"excerpt":{"rendered":" Most organisations wrote their AI policy in 2023 or 2024. The technology has moved so fast that those policies are now dangerously inadequate.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,23],"tags":[],"class_list":["post-9007","post","type-post","status-publish","format-standard","hentry","category-artificial-intelligence","category-technology"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/iamglover.com\/index.php?rest_route=\/wp\/v2\/posts\/9007","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/iamglover.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/iamglover.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/iamglover.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/iamglover.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9007"}],"version-history":[{"count":1,"href":"http:\/\/iamglover.com\/index.php?rest_route=\/wp\/v2\/posts\/9007\/revisions"}],"predecessor-version":[{"id":9068,"href":"http:\/\/iamglover.com\/index.php?rest_route=\/wp\/v2\/posts\/9007\/revisions\/9068"}],"wp:attachment":[{"href":"http:\/\/iamglover.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9007"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/iamglover.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9007"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/iamglover.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9007"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What Your 2023 Policy Doesn’t Cover<\/h2>\n
What a 2026 Policy Needs<\/h2>\n