The company’s AI usage policy is an internal document and set of procedures that define which AI services are allowed, what data can be sent to them, who is responsible for each AI use case, how results are reviewed, and how compliance with the rules is measured. A good policy does not ban neural networks; it makes their use manageable: employees know what is allowed, leadership can see where AI is already in use, and risks related to personal data and model errors are assigned to specific people.
Prepared by AIrassvet based on public sources, verified October 9, 2026. It is intended for business owners, CEOs and IT directors, information security leaders, and lawyers at Russian small and midsize companies. This article is not legal advice: the policy text and data processing procedures should be reviewed with a lawyer. AIrassvet is not affiliated with the companies and researchers mentioned, and the section at the end describes the publisher’s services.
Contents
- Why this topic became a hot issue in October 2026
- What an AI usage policy is and what it is not
- At a glance: what the policy includes
- Roles: who is responsible for AI in the company
- What data can be sent to AI
- AI use case register
- How to grant access to AI agents
- What to consider under Federal Law 243-FZ
- Metrics: how to tell whether the policy is working
- 30-day policy rollout plan
- Common mistakes
- Frequently asked questions
- Primary sources and verification method
Why this topic became a hot issue in October 2026
On October 5, 2026, CNews published the results of a K2Tech study of industrial enterprises. The survey included 150 executives from large industrial companies. Key AI governance figures:
- in 79% of cases, management expectations for AI exceed the company’s actual capabilities: 30% reported a major gap, 49% said it was only partially aligned, 5% said it fully aligned, and another 16% could not assess it;
- in 19% of companies, responsibility for generative AI risks is not formally assigned;
- in 23% there is no systematic AI governance with policies, roles, and controls;
- another 30% assess the effectiveness of AI governance without formal metrics — “based on how the process is going”;
- in 37% of companies, no separate budget is allocated for data and AI governance; the work is handled within current IT tasks.
The study covers large industrial companies, and its percentages cannot be directly applied to small businesses. But the picture is familiar for companies of any size: neural networks are already in use, while rules, owners, and metrics usually appear later — often only after the first incident.
At the same time, usage is growing. According to a Selectel study cited by the company in an October 8, 2026 statement, 55% of companies are already actively running pilots and launching targeted AI projects, and 23% have reached production use. The methodology and sample for this survey were not disclosed in the statement, so these figures should be read as a reference point rather than market statistics.
What an AI usage policy is and what it is not
An AI usage policy is not a list of bans for employees; it is a description of the governance system: roles, data rules, use case register, result review process, and compliance metrics. A two-page document that says “do not upload confidential data into ChatGPT” covers only a small part of the task.
What the policy is not:
- Not a ban. A total ban usually pushes usage into personal accounts and employees’ phones, where the company can no longer see anything.
- Not instructions for a specific service. Services change faster than the document; the policy describes principles and data classes, while the list of approved services lives in a separate appendix.
- Not a document for IT alone. AI use cases appear in sales, marketing, HR, accounting, and legal — the process owners should be responsible for them.
In the policy, it is useful to distinguish three levels: personal productivity (an employee drafts an email in a chat assistant), process-level use case (an AI agent responds to customers or processes incoming documents), and automated decision (AI itself changes the status of a request, sets a price, or declines it). The higher the level, the stricter the rules.
At a glance: what the policy includes
| Section | What it records | Owner |
|---|---|---|
| Purpose and scope | Which departments, services, and task types the policy covers | Company leadership |
| Roles and responsibilities | AI owner, use case owners, security, legal | Company leadership |
| Data classes | What is allowed, what is allowed after anonymization, and what cannot be sent to AI | Security and legal |
| Approved services | List of models and services, where they run, and under what terms | IT and security |
| Use case register | Each process-level AI use case with an owner, data, and metric | AI owner |
| Results Review | Where human oversight is required and how errors are logged | Scenario Owners |
| Incidents | What counts as an incident, where to report it, and how to investigate it | Security |
| Training | Who is trained on what, and how often retraining is required | HR and the AI Owner |
| Metrics and Review | How to measure policy compliance and how often to update it | AI Owner |
Next, we’ll go into each section in more detail.
Roles: who is responsible for AI in the company
A K2Tech study shows the most common gap: responsibility for generative AI risks is not formally assigned. For a small or midsize business, you do not need a separate committee — four roles are enough, and some can be combined.
- AI Owner. Maintains the scenario register, approves new services, collects metrics, and reports to management quarterly. In a small company, this can be the CIO or Head of Digital Transformation.
- Scenario Owner. The manager of the department where AI is used: responsible for output quality and for making sure employees review answers where required.
- Security and Data Protection. Defines data classes, checks where requests are physically processed, and handles incidents.
- Legal Counsel. Reviews personal data processing consents, AI vendor contracts, and scenarios where a decision affects people’s rights.
A useful rule: every operational AI scenario must have one named owner. If you cannot name an owner, the scenario is not ready to launch.
What data can be sent to AI
Data classes are the core of the policy. Without them, employees have to decide on their own whether they can paste a customer contract or a CRM export into a chat tool.
| Data class | Examples | Default rule |
|---|---|---|
| Public | Website copy, public price lists, general questions | Allowed in any approved service |
| Internal | Policies, templates, internal communications without personal data | Only in services from the approved list, with training on data disabled |
| Confidential | Contracts, financial performance, commercial terms | Only in services deployed within the company environment or with a provider under contract and processing in Russia |
| Personal data | Full names, phone numbers, resumes, customer data | Only with a valid legal basis and in services that meet the requirements of Federal Law No. 152-FZ; anonymize where possible |
| Highly sensitive | Health data, biometrics, partners’ trade secrets | Do not send to external services without a separate decision from Legal and Security |
We wrote in detail about when customer data can be sent to neural networks and how to anonymize it in the article “Can Customer Data Be Sent to AI?”.
A separate rule is needed for automated decisions about people. Article 16 of Federal Law No. 152-FZ prohibits decisions that produce legal consequences for a person or otherwise affect their rights being made solely on the basis of automated processing of their personal data — except where there is written consent or the law directly provides otherwise. In the policy, it is convenient to phrase it like this: AI may recommend rejecting a customer or candidate, but a person confirms the decision.
AI Scenario Register
The AI scenario register is a table where each operational use of AI has an owner, data source, model used, processing location, autonomy level, and quality metric. It answers management’s question, “Where is AI already working in our company?” and security’s question, “Where is our data going?”
Minimum required fields:
- scenario name and department;
- scenario owner;
- what data is used as input and what class it belongs to;
- which model or service is used and where requests are physically processed;
- autonomy level: suggestion to a person, action with confirmation, or fully autonomous action;
- where human review is mandatory;
- quality metric and date of the last review;
- fallback option if the service is unavailable.
People often forget the last field. If an AI support assistant stops responding, the scenario owner should already know who takes customer requests manually and how.
How to grant access to AI agents
For AI agents that do more than respond and actually act in company systems, the policy should define access rights the same way it does for employees. The agent gets a separate account, the minimum necessary permissions, and an action log. This approach is explained in detail in the article “AI Agent as a Digital Employee: Account and Permissions”.
Practical rules for agents:
- the agent works under its own account, not an employee’s account;
- permissions are limited to one task: being able to read tickets does not mean being able to change prices;
- actions that cannot be undone (payment, deletion, sending to a customer) require human confirmation until scenario metrics prove otherwise;
- the agent’s action log is retained and accessible to the scenario owner and Security.
What to consider under Federal Law No. 243-FZ
Federal Law No. 243-FZ “On Supporting the Development of Artificial Intelligence Technologies in the Russian Federation” takes effect on September 1, 2026, and regulates large foundation models — from 1 billion parameters. For a company that simply uses neural networks, there are currently few direct new obligations, but two points are worth building into the policy now:
- Data processing location. Starting March 1, 2027, the government will define cases where only sovereign or national models are allowed. For systems that are already live on that date, the law provides a transition period until September 1, 2032, provided that the data is processed and stored in Russia. The “where requests are processed” field in the scenario registry is the direct answer to this question.
- Rights to generated outputs and AI content labeling. Starting March 1, 2027, rules take effect requiring users to be notified about rights to generated outputs and making it possible to label audio and visual materials. In the policy, it is worth defining who in the company monitors service terms and decides whether to add a label to generated videos and images.
A detailed article-by-article breakdown of the law is available in the material “AI Law 243-FZ: What It Means for Business”.
Metrics: how to tell whether the policy is working
A K2Tech study notes that 30% of companies assess AI governance without formal metrics. Below is a set of metrics you can collect without a separate system, using the registry and logs.
| Metric | How to calculate it | Why it matters |
|---|---|---|
| Registry coverage | Scenarios with an owner / all known scenarios | Shows how much AI is operating “in the shadows” |
| Share of scenarios with a quality metric | Scenarios with a metric / all scenarios in the registry | Without a metric, you cannot decide whether to scale a scenario |
| Share of employees who completed training | Trained / all those with access to AI | A policy without training is not enforced |
| Data incidents | Number of times data of the wrong class was transferred in a quarter | Shows whether data classes are working |
| AI errors that reached the customer | Number of confirmed cases in a quarter | Shows whether human review is working |
| Time to approve a new service | Days from request to decision | If it takes too long, employees will work around it |
The last metric matters more than it seems. If approving a new service takes a month, the policy starts working against itself.
30-day policy rollout plan
- Week 1. Inventory. Survey department heads: which AI services employees use, for which tasks, and with what data. Draft the first version of the registry, even if it is incomplete.
- Week 2. Roles and data classes. Assign an AI owner and scenario owners. Together with legal and security, approve data classes and the rule for automated decisions about people.
- Week 3. Service list and review rules. Define approved services for each data class and the cases where a human review is mandatory. Describe the approval process for a new service with a clear timeline.
- Week 4. Training and launch. Provide brief training for employees with “allowed / not allowed” examples, publish the policy, and set the date for the first review in one quarter.
If the data for AI scenarios is not ready, the policy will quickly run into this barrier: in the K2Tech study, only 5% of companies said their data was fully ready. For data preparation, see the article “Preparing Data for AI Implementation”, and for how to choose processes for the first use cases, see “Business Process Audit Before Implementing AI”.
Common mistakes
- Total ban. Usage moves to personal accounts; risks increase, and visibility disappears.
- A policy without a registry. There is a document, but no one knows where AI is already in use.
- An owner without authority. The AI owner cannot stop a scenario or require a metric.
- The same rules for everything. A draft email and an automated rejection to a customer require different levels of control.
- No fallback mode. If the service fails, the process stops because no manual procedure was documented.
- A document with no review cycle. Services, models, and laws change; a policy that has not been updated for six months is outdated.
Frequently asked questions
What is an AI use policy in a company?
It is an internal document and a set of procedures that define approved AI services, data classes, the people responsible for each AI scenario, the review process for results, and compliance metrics. Its purpose is to make the use of neural networks manageable, not to ban it.
Does a small business need an AI use policy?
Yes, if employees already use neural networks to work with clients, contracts, or personal data. For a small company, a short document is enough: roles, data classes, a list of approved services, and a scenario registry.
Who should be responsible for AI in the company?
You need one AI owner who maintains the registry and approves new services, plus scenario owners in the business units who are responsible for output quality. Security defines the data classes, and legal reviews consents and contracts.
Can employees use ChatGPT and other foreign services?
That is determined by the policy based on data classes. Public data can usually be processed in any approved service, while personal and confidential data can only be processed where the requirements of Federal Law 152 are met and it is clear where requests are physically processed.
Can AI make decisions about customers or candidates on its own?
Article 16 of Federal Law 152 prohibits decisions that produce legal consequences for an individual solely on the basis of automated processing of their personal data, except in cases of written consent or where expressly provided by law. It is safer for AI to make recommendations while a person confirms the decision.
How often should an AI use policy be reviewed?
Once a quarter and after each significant event: a new service, a data incident, or a legal change. New rules under 243-FZ take effect on March 1, 2027, so it is worth scheduling a review before that date.
Primary sources and verification method
Checked on October 9, 2026:
- CNews, October 5, 2026 — a K2Tech study of 150 senior leaders at large industrial companies: AI expectations, risk ownership, AI governance, data, and budgets.
- CNews, October 8, 2026 — Selectel survey data on the share of companies at the pilot stage and in production AI deployment.
- ConsultantPlus, 243-FZ — the law supporting the development of AI technologies, the effective dates of the rules, and the transition period.
- ConsultantPlus, Federal Law 152, Article 16 — decisions based solely on automated processing of personal data.
The research figures are cited from CNews’ retelling, not from the full reports. The policy structure, data class tables and metrics, 30-day plan, and list of errors are an editorial analysis by AIrassvet; the article does not present original surveys or project results.
How AIrassvet helps bring order to AI use
If your company is already using neural networks but still has no rules, owners, or register in place, the issue can be broken down step by step. On the AIrassvet website, which also uses the name “AI Studio by Vladimir Lomtev,” the relevant areas are described as follows:
- Audit of processes where employees are already using AI: which tools, which data, where an owner and metric are needed.
- A corporate AI workspace where employees work with approved models instead of personal accounts.
- Deployment of a language model on the company’s servers or in a secure cloud for scenarios involving confidential and personal data.
- Team training: how to use AI in accordance with the policy rules and how to verify results.
The first step is to choose one process where AI is already being used, describe its current metrics, data sources, constraints, and the criterion by which you will consider the rules effective.
Bottom line: a policy makes AI manageable
The K2Tech study shows that AI is already in use at a noticeable share of large companies, while accountability, rules, and metrics are lagging behind. For small and midsize businesses, the gap is usually even wider: neural networks come in through employees, not through a formal project.
An effective AI use policy includes four roles, data classes, a scenario register, human review where a decision affects people, and several metrics reviewed quarterly. Start by inventorying what is already in use—this will help you see the real risks and the points where AI delivers value before you write prohibitions.