Generative AI Policies for Businesses: What Companies Need Before Employees Start Using AI Tools

In this episode of The AI-Savvy Lawyer, host Lisa Mosbey talks with Charlyn Ho, founder of Rikka Law Group, about the AI policy for employees every company needs before generative AI reaches daily work. Without one, an employee can paste company data into a free AI tool that may train on it, and that data may not come back. They cover what the policy should include, who should own it, and why a policy nobody understands does no good.

Topics covered

• Why letting employees use generative AI before a policy exists puts trade secrets and confidential information at risk
• The difference between free consumer AI tools and enterprise versions, and why personal logins create their own problem
• The bare minimum every AI governance policy should include
• How requirements change by industry, using a hospital and healthcare data as the example
• The "Wall Street Journal test" and the reputational cost of an AI data incident
• Memory, retention, deletion and training settings, and why they have to be vetted before employees use a tool
• How generative AI use can put intellectual property at risk, including the patentability of new inventions
• Accuracy and accountability: why anything with a legal consequence needs human verification
• Who should own AI governance, and why training is what makes a policy work
• AI agents, and how principal-agent law may apply when an agent acts on its own
• What separates companies that adopt AI strategically from those adopting it without structure

Key takeaways

1. Start with the bare minimum: no tools that train on your company's data. Charlyn's baseline for any AI governance policy is simple. Employees should not use any AI tool that allows the model provider to train on the employer's data. Everything else depends on the company's industry, maturity and risk profile.

2. The version and the login matter as much as the tool. Free consumer versions generally allow the provider to train on your inputs. Using a personal email login also means the employer has no visibility into what was shared. Companies should set guidelines for using enterprise versions, or versions with security protections that fit their own privacy and risk profile.

3. Once data goes in, it may not come back. Unless the tool is set up correctly, you can't retrieve data after it has been entered. Memory settings, retention periods, deletion options and the provider's training rights all need to be vetted before employees start using a tool. Rikka works with clients on exactly this: understanding the legal risk, then setting up tools like Claude, ChatGPT and Gemini so the settings match the requirements. Learn about Rikka's AI & Automation services.

4. A policy in a drawer does nothing. If a policy says "no confidential information in AI tools" but employees can't tell what counts as confidential, it won't change behavior. Training is what turns a policy into something people act on. Legal should be a primary stakeholder, working alongside technology, cybersecurity and other teams, because AI governance is multidisciplinary.

5. Verify anything with a legal consequence. Generative AI output sounds polished and confident, even when it's wrong. Charlyn has seen AI invent a statute that didn't exist. Her firm's governance policy requires attorneys to verify anything with a legal consequence, which kept that error from ever reaching a client.

6. The law on AI agents is still developing. There's no single answer yet on who is responsible when an AI agent acts on its own. Principal-agent law is one starting point: the principal is generally responsible for what its agent does. How that applies to the company that built the agent, versus the company that deployed it, is still being worked out.

What to do next: if your team is already using AI and the policy isn't written yet, start with an AI Governance Assessment. Rikka maps what your team is using today and helps you put a policy and training in place that fit how your company actually works. Talk to Rikka about an AI Governance Assessment.

Resources mentioned

• The AI-Savvy Lawyer by Charlyn Ho, and its AI Competence Ladder framework. [PLACEHOLDER, needs book or waitlist link]
• HIPAA, the federal law that regulates healthcare data, plus state-level healthcare privacy laws
• U.S. Department of Health and Human Services, which can impose civil penalties for healthcare data violations
• Principal-agent law, the general legal concept of a principal's responsibility for its agent's actions
• AI tools discussed: ChatGPT, Claude and Gemini
• Related reading: [PLACEHOLDER, needs a link to an existing Insight in the AI & Automation pillar]
• Privacy and data protection support: Rikka's Privacy & Cybersecurity services

Favorite quote

"A policy by itself, sitting in a drawer, a digital drawer, so to speak, really does no good unless people actually understand it."
Charlyn Ho, Founder, Rikka Law Group