· AI
Before You Write an AI Use Policy, Read What the Vendor Already Promised You
Most AI use policies tell employees what not to do and never mention the one document that already decided who is liable when something goes wrong.
Most AI acceptable-use policies are written as a list of employee rules: do not paste client data into a chatbot, do not trust the output blindly, ask before you automate a decision. Those rules matter. But they get drafted before anyone has actually read the document that already set the terms of the relationship: the commercial contract with the AI vendor itself. That contract decides whether your data trains someone else's model, how long it sits on a server you do not control, and who pays if an employee's AI-assisted work triggers a copyright claim. Writing an internal policy without reading it first is writing the easy half of the job.
My position: the policy's real function is to translate the vendor's contract into rules a non-lawyer can follow day to day, and most companies skip the translation because they skip the reading.
The case for not bothering
Here is the honest version of why most companies skip this. Enterprise AI contracts are standard-form agreements that a small or mid-size business has almost no power to change, so reading them closely can feel like reading a lease you cannot negotiate a word of. The vendors involved have real legal and security teams, and a company picking Anthropic or Microsoft over an unknown startup has already made the biggest risk decision by choosing a vendor with the resources to stand behind its product. For a business with no legal staff, writing generic, cautious rules for employees and trusting the vendor's standard terms is a defensible way to spend limited time.
What the actual terms say
The defense gets weaker once you compare what vendors actually promise, because it is not interchangeable boilerplate. Anthropic's commercial terms bar Anthropic from training its models on customer content, a restriction that covers both the prompts a business sends in and the responses it gets back. On liability, Anthropic will defend a commercial customer against a third party's claim that the customer's authorized use of the service infringes that party's intellectual property, but the terms carve out one specific exception: claims that trace back to the data or inputs the customer supplied are not covered. In plain terms: Anthropic stands behind its model's output, not behind whatever your employees fed into it.
Microsoft's Copilot Copyright Commitment, covering Microsoft 365 Copilot, GitHub Copilot, and Bing Chat Enterprise, makes a similar promise with a different condition attached. Microsoft says it will defend the customer and pay resulting judgments or settlements from a covered copyright suit, but only "as long as the customer used the guardrails and content filters we have built into our products." The protection is conditional on a configuration setting staying turned on, not just on which product you bought.
Put those two side by side and the shared lesson is not pick the better vendor. It is that indemnification in a sales deck covers a narrower promise than it sounds like, and the narrow part is exactly where day-to-day employee behavior decides whether you are actually covered. An employee pasting unlicensed material into a prompt, or an admin who quietly disables a content filter because it slows people down, can switch off protection the company believed it already had, with nobody noticing until a claim arrives.
What this means for the policy itself
This is the gap a real acceptable-use policy should close, and it is a different exercise than writing a general code of conduct. Pull the actual commercial agreement, not the marketing page, for every AI tool in use. Find the training-data clause, the retention clause, and the indemnification clause, and note exactly what voids each one: whose data, which setting, which use case. Then write one specific rule in the policy for each condition you found, naming the setting or behavior that keeps the company inside the protection it already paid for. A policy built this way is shorter and more useful than a generic ban, because every line maps to a real exposure instead of a hypothetical one.
Nobody is going to pass a law that reads your AI contracts for you, and I would not want one that tried. This is a few hours of a careful read, not a compliance department. It is exactly the kind of practical governance work MojoAI does alongside a readiness assessment, because the vendor terms and the internal policy only work as a pair. If your policy was written before anyone pulled the actual contract, that is worth fixing before your next renewal.
Sources
References used in this article. Links also appear alongside the relevant claims.
Let's make it happen.
You don't need a polished brief. A couple of lines about where you want your company to go is plenty, and we'll come back with what we'd tackle first.
We scope the work around your goals and timeline before quoting anything, so you know exactly what you're getting.