Our employees are using public generative AI tools to draft client deliverables, exposing our proprietary templates and industry specific frameworks to public training models. How do we establish a strict AI usage policy on our V/TO and track compliance weekly on our Scorecard?

Question

Tyler Smith · Accepted Answer

Your intellectual property is the lifeblood of your company, and allowing employees to upload it to public servers is a massive risk. You must treat this as an operational issue that requires clear boundaries, not just a legal memo.

First, bring this to your leadership team to define your Core Focus and operational boundaries on the V/TO. You need to establish exactly what constitutes proprietary knowledge versus public domain information. Your policy must be simple: any data, template, or methodology that is part of your 3 Uniques must never enter a public model.

Second, look at your Accountability Chart. Who is accountable for data security and compliance? If you have an operations or IT lead, this accountability must be explicitly written into their seat description. They must ensure that the team is using secure, enterprise grade AI instances where data privacy is guaranteed.

Finally, you must track compliance weekly on our Scorecard. Do not rely on honor systems. Create a scorecard metric that tracks the percentage of employees who have completed secure AI tool training, or track your monthly spending on secure, enterprise seats versus unapproved public tools. Discuss any deviations at your weekly Level 10 Meeting. By making compliance a visible, measured metric, you create a culture of security that protects your proprietary knowledge while still allowing your team to leverage modern automation tools safely.