How Many Companies Have an AI Policy? [2026]

How many companies have an AI policy? When AISA asked 84 people starting the AI fluency assessment whether their team or organisation has guidelines for AI use, just 36.9% said they work under a formal policy. That means roughly two in three people operate without clear, written rules, relying instead on informal norms, stalled discussions, nothing at all, or simply not knowing what the rules are.

1. Yes, formal policy36.9%31
2. Informal norms13.1%11
3. It's been discussed but nothing set17.9%15
4. No25.0%21
5. I don't know7.1%6

84 people answered, 13 September to 16 September 2026. Source: AISA research, aisa.to

Those numbers matter for anyone managing a team, running HR, or reporting on workplace AI adoption. Below, we break down what people told us, what the gaps look like, and what you can do about them.

How Many Companies Have an AI Policy?

Only 36.9% of people AISA asked said their team or organisation has a formal AI policy. That is the single largest group, but it still leaves the majority without documented guidelines. The exact question was: "Does your team or org have any guidelines for AI use?"

The remaining 63.1% split across four other answers, each telling a different story about the state of AI governance in practice:

• Informal norms account for 13.1%. These teams have unwritten expectations (maybe a Slack message from a manager, maybe a verbal agreement) but nothing codified.
• Discussed but not set covers 17.9%. The conversation has started, but it stalled before producing a document.
• No guidelines at all is the second-largest group at 25.0%. A quarter of respondents work in environments with zero AI rules, written or otherwise.
• "I don't know" rounds out the picture at 7.1%. Six people could not say whether their organisation has AI guidelines.

Taken together, 42.9% of people either have no policy or do not know if one exists. That is a significant governance blind spot.

Formal Policies Are the Exception, Not the Rule

A formal policy means someone wrote it down, distributed it, and (ideally) enforced it. At 36.9%, that is the plurality, but not the majority. For managers and HR leaders, the takeaway is straightforward: do not assume your competitors or peers have this figured out. Most do not.

The "Discussed but Nothing Set" Group

The 17.9% who said guidelines have been discussed but not finalised represent stalled intent. These organisations recognised the need but did not follow through. If your team is in this bucket, the gap between "we talked about it" and "here is the document" is where risk accumulates.

How Many Teams Run on Informal AI Norms?

13.1% of people said their team relies on informal norms rather than a written policy. Informal norms might look like a manager saying "don't paste client data into ChatGPT" in a standup, or a team lead sharing prompt tips in a channel. They are better than nothing, but they do not scale, they are not auditable, and they leave new hires guessing.

Why Informal Norms Break Down

Informal norms depend on institutional memory. When someone leaves, the norm leaves with them. When a new tool launches, nobody knows whether the old norm applies. And when something goes wrong (a data leak, a hallucinated legal clause sent to a client) there is no document to point to.

From Norms to Policy

If your team already has informal norms, you are closer to a formal policy than you think. The work is documentation, not invention. Write down what people already do, fill the gaps (especially around data privacy), get sign-off, and distribute it.

How Many Employees Do Not Know If There Are AI Rules?

7.1% of people (6 out of 84) said they do not know whether their organisation has AI guidelines. That number might look small, but it points to a communication failure that likely extends beyond the people who selected it.

The Awareness Gap

If someone does not know whether a policy exists, they cannot follow it. This is not a knowledge problem on the employee's side; it is a distribution problem on the organisation's side. Policies buried in a wiki nobody reads, or announced once in an all-hands six months ago, might as well not exist.

What "I Don't Know" Really Signals

Combine the 7.1% who do not know with the 25.0% who said there are no guidelines, and you get 32.1% of people operating in a policy vacuum. For HR and compliance teams, that is the number that should drive action. Even if a policy exists on paper, it fails if a third of the workforce cannot locate it.

Does My Company Need an AI Policy?

Yes, and the data suggests most organisations are behind. When 63.1% of people lack a formal policy, the question is not whether you need one but how quickly you can ship one.

The external data reinforces the urgency. According to BCG's AI at Work 2025 report (surveying over 10,600 workers across 11 countries), 54% of workers would use AI tools even if not authorised. Separately, the Microsoft and LinkedIn Work Trend Index from May 2024 found that 78% of AI users bring their own AI tools to work. People are using AI whether or not you have a policy. The policy does not control whether AI gets used, it controls how.

The Cost of Waiting

Every week without a policy is a week where people make individual judgements about what data to share with AI tools, which outputs to trust, and where to disclose AI involvement. Some of those judgements will be good. Some will not. A policy sets the floor.

Who Owns the Policy?

In most organisations, AI policy falls between legal, IT, HR, and engineering, which means it falls through the cracks. Assign a single owner. Give them a deadline. A two-page document shipped next week beats a comprehensive framework shipped never.

If you want to understand where your team actually stands before writing policy, a team AI assessment gives you a baseline. You cannot write effective guidelines without knowing what people already do and where the gaps are.

What Happens When AI Use Has No Guidelines?

Without guidelines, AI use becomes invisible, inconsistent, and risky. The 25.0% of people who said their organisation has no AI guidelines are not necessarily avoiding AI, they are using it without guardrails. This is what the industry calls shadow AI.

Shadow AI Is Already Happening

Shadow AI is the use of AI tools without organisational knowledge or approval. It is the modern equivalent of shadow IT, but faster-moving and harder to detect. When BCG reports that 54% of workers would use AI even without authorisation (BCG, June 2025), and Microsoft finds that 78% bring their own AI tools to work (Microsoft, May 2024), the pattern is clear: people are not waiting for permission.

The risk is not that people use AI. The risk is that they use it without knowing what data is safe to share, which outputs need human review, or when to disclose AI involvement to clients and stakeholders.

Inconsistency Across Teams

Without a policy, one team might paste proprietary code into a public model while another team avoids AI entirely out of caution. Both responses are suboptimal. A policy creates a shared standard, not to restrict use, but to make it predictable and auditable.

The Compliance Angle

Regulations like the EU AI Act are raising the stakes. Organisations deploying or using AI systems in regulated contexts need documented practices. "We didn't have a policy" is not a defence.

What Should an AI Policy Cover?

A minimum viable AI policy covers data handling, acceptable use cases, output review requirements, and disclosure expectations. You do not need a 40-page document. You need clear answers to the questions people are already asking themselves every time they open an AI tool.

Data Classification

Which data can go into AI tools, and which cannot? At minimum, distinguish between public, internal, confidential, and restricted data. Specify which tools are approved for each tier. This is the single highest-impact section of any AI policy.

Acceptable Use

Define what AI can be used for and where human judgement is required. Drafting an internal email? Probably fine. Generating a legal contract without review? Probably not. Be specific, vague policies get ignored.

Output Review and Verification

AI outputs need review. The policy should state who is responsible for checking AI-generated work and what level of review is expected. A one-line summary in a Slack message needs less scrutiny than a client-facing report. Tie the review standard to the stakes of the output, following a stakes-based review approach.

Disclosure

When should people disclose that AI was involved? To clients? In published content? In code reviews? Set expectations so people do not have to guess.

Training and Fluency

A policy without training is a document without teeth. People need to understand why the rules exist and how to follow them. Measuring AI fluency across your team tells you where training is needed most. The AI skills gap is real, and policy alone does not close it, but it creates the framework for closing it.

Review Cadence

AI tools and capabilities change fast. A policy written in January may be outdated by June. Set a review schedule (quarterly is a reasonable starting point) and assign someone to own updates.

Turning Data Into Action

The gap between "we should have a policy" and "we have a policy" is where most organisations sit. AISA's data shows 17.9% have discussed guidelines without setting them, and another 25.0% have not started at all. If you are in either group, here is a practical sequence:

1. Measure first. Understand how your team actually uses AI today. A team AI assessment surfaces what people know, what they do, and where the risks are, before you write a single policy line.
2. Start small. A two-page policy covering data classification and output review handles the highest-risk scenarios. Ship it, then iterate.
3. Communicate clearly. The 7.1% who said "I don't know" are a reminder that policies only work if people can find them. Pin it, link it, reference it in onboarding.
4. Build fluency alongside policy. Policy tells people what to do. Training helps them understand why and how. The two reinforce each other.
5. Review regularly. Set a calendar reminder. Update the policy when tools, regulations, or your own understanding changes.

If you want to know where you personally stand, take the AI fluency assessment, it takes one conversation and gives you a measured score across prompting, critical thinking, technical understanding, workflow design, and responsible use.

About this research

This finding comes from AISA's own research. AISA asks a short research question of people as they start the AISA AI fluency assessment, one question at a time. The question in the chart above was asked from 13 September to 16 September 2026, worded exactly as shown and with the answers in the order shown, and 84 people answered it. Each person counts once: when someone answered more than once, their latest answer is the one counted.

More findings from this research are collected in AISA research and data.

How to cite this research: AISA (2026). "How Many Companies Have an AI Policy? [2026]". AISA research. https://aisa.to/blog/how-many-companies-have-an-ai-policy

---

Related reading: AI Skills Gap Statistics [2026 AISA Data], see how AI skill levels break down across real people.

Related reading: AI Training for Employees: Measure First [2026], why measurement should come before training spend.

Related reading: AI Adoption Metrics: Why Logins Mislead [2026], what login counts miss about real AI capability.

Frequently Asked Questions

Do Most Companies Have an AI Policy?

No. AISA research found that only 36.9% of people report working under a formal AI policy. The majority (63.1%) rely on informal norms, stalled discussions, no guidelines at all, or do not know whether guidelines exist. Having a policy is still the exception rather than the norm.

Does a Small Company Need an AI Policy?

Yes. Size does not eliminate the risks of unguided AI use, data leaks, unreliable outputs, and inconsistent practices affect teams of five just as they affect teams of five thousand. A small company can start with a short document covering data classification, acceptable use, and output review. The effort is minimal; the protection is significant.

What Is Shadow AI?

Shadow AI is the use of AI tools without organisational knowledge or approval. It is the AI equivalent of shadow IT. Microsoft's 2024 Work Trend Index found that 78% of AI users bring their own tools to work, and BCG's 2025 report found 54% would use AI even without authorisation. Shadow AI is not a hypothetical risk, it is the default state for organisations without clear guidelines.