AI policy

A policy written in 2023 for basic chatbots has very little to say about an agent that can read a ticket and query a monitoring API. So it says no.

Insights and thoughts Andrew Wood

AI is moving fast, and compliance frameworks are struggling to keep up. A lot of AI policies at service providers were written before the tools they’re supposed to govern even existed.

That’s not a dig at whoever wrote them. They made sense at the time. A policy written in 2023 around basic chatbots and pasting customer data into a public browser window was fit for purpose then. It has very little to say about an agent that can read a ticket, check a runbook, query a monitoring API and suggest a fix. So the policy does the only thing it can, which is say no.

We saw the same pattern ten years ago with shadow IT and early cloud adoption. Blanket bans didn’t stop people using the tools; they just pushed the usage out of sight, onto personal accounts and unmonitored devices where governance couldn’t see it at all.

The constraint on AI in operations now is mostly governance, not capability. The people best placed to update that governance are the ones who know which clients have which contractual commitments, what data residency rules apply, and where the sensitive data actually lives. That’s usually someone in operations, not a committee that meets once a quarter.

If your AI policy is older than the tools your engineers are asking about, it needs rewriting by people who understand the operational risk. Otherwise it stays as a blanket no, or worse, people quietly work around it.