Do you need both a shadow AI policy and an AI acceptable use policy?

By the Shadow AI Policy team

Most companies with 50–500 people don't need two documents: they need one AI acceptable use policy with a clear shadow AI section. Split them only if you handle regulated data or have separate teams running approved tools and unapproved-tool discovery.

This post explains what question each document answers, puts them side by side, and gives you a way to decide between one document and two. It also covers what the shadow AI part has to say about disclosure, tool review and the tools people are already using. No law we're aware of tells you how to divide these documents, so treat this as a judgment call rather than a compliance requirement.

What question does each policy answer?

An AI acceptable use policy answers "How may I use the AI tools this company has approved?" A shadow AI policy answers "What happens with AI tools the company hasn't approved or can't see?" The first sets the rules for known use. The second deals with the gap between what's on your approved list and what people are doing.

That gap is why the distinction matters. A rule about what data can go into an approved assistant doesn't tell an employee what to do about the meeting-notes app they signed up for last spring. It doesn't tell IT what to do when a new AI feature shows up inside software you already pay for, either. If you want the full definition first, read our guide to what shadow AI is and how it enters a company.

The two also speak to people differently. An acceptable use policy is an everyday reference: staff check it when they're deciding whether a task is allowed. A shadow AI policy is an exception process: staff need it when they've found a tool that isn't on the list, or when they've already been using one and need a safe way to say so.

How do the two policies compare side by side?

They differ most on trigger and enforcement. Scope and audience overlap more than the names suggest, which is the main reason one document often works. The table below shows a typical setup, not a legal standard, so adjust the owners to match your org chart.

Question	AI acceptable use policy	Shadow AI policy
Scope	Approved tools, permitted tasks and the data allowed in each tool	Unapproved or unknown tools, including AI features switched on inside existing software
Audience	Every employee and contractor who uses AI at work	Every employee and contractor, plus the reviewers in IT, security and legal
Usual owner	HR or legal, with IT input	IT or security, with HR and legal input
What triggers it	An everyday task involving an approved tool	A tool request, a self-disclosure or a discovery by IT
When someone breaks it	Coaching or discipline, scaled to the data and the harm	Stop using the tool, assess what data went in, then apply discipline if the person hid it or ignored a decision

The last row is where companies most often get this wrong. If disclosure and concealment carry the same penalty, nobody has a reason to disclose. Make the difference explicit, and have employment counsel review the discipline language before you publish it.

When is one combined document enough?

One combined document is enough when the same small group writes the rules and reviews the tools, and you don't handle regulated data at a level that demands a formal review trail. For most companies under about 250 people, that's the right call. The 250 figure is our rule of thumb, not a legal threshold.

A single document has practical advantages. Employees have one place to look, one policy to acknowledge and one set of definitions. You also avoid the drift that sets in when two documents define "approved tool" differently, then get updated on different schedules.

Keep the shadow AI part as its own labeled section so people can find it when they need it. Our AI acceptable use policy template has the wording, so you don't have to draft from a blank page.

When is a separate shadow AI policy worth it?

A separate policy is worth it when the review process has become an operating procedure with its own owners, records and service levels. At that point, folding it into a document written for every employee makes both parts worse. Staff get buried in process detail, and reviewers don't get enough of it.

Split the documents if two or more of these are true:

• You handle regulated data, such as protected health information under HIPAA, and need a documented decision for each tool. Our comparison of BAA and HIPAA status across AI tools is a useful starting point.
• You have more than about 250 people, or enough tool requests that reviews need a queue and a target turnaround.
• Different teams own the two jobs. HR runs the use rules, for example, while security runs discovery and review.
• You use technical discovery, such as network or browser monitoring, and need to explain what it collects and who can see it.
• Customer contracts or security questionnaires ask you to show how you handle unapproved tools.

If you do split them, have the shadow AI policy point to the acceptable use policy for every shared definition. Don't restate those definitions. And keep the employee-facing instruction short enough to fit on a single page, with the reviewer procedure behind it.

What should the shadow AI part actually say?

It should say how staff disclose a tool, how that tool gets reviewed and what happens to tools already in use. Those three parts turn "don't use unapproved AI" into something people can follow.

How staff disclose a tool

Give people one channel, such as a short form or a shared inbox, and ask only what the reviewer needs: the tool's name, the task, the kind of data involved and whether the account is personal or company-paid. Say plainly that AI features added to existing software count, because many people won't think of those as new tools.

How a tool gets reviewed

Name the reviewer and commit to a turnaround. Five business days is a sensible target for a simple request, though that's our suggestion and not a standard. Limit the possible outcomes to three: approved, approved with limits, or declined. Record the reason, and add the result to your approved list so the next person doesn't have to ask. Our AI tool risk directory can give a reviewer a head start on common products.

What happens to tools already in use

Set a time-limited disclosure window, such as 30 days after the policy launches, and promise that nobody will be disciplined just for reporting a tool during that window. Be precise about the limits: the promise covers the act of having used the tool, and it may not cover deliberate misconduct or legal duties that a disclosure brings to light. If regulated or confidential data went into a tool, that needs its own assessment, even when the employee did nothing but try to get work done.

The goal of the first 30 days is an accurate list, not a list of people to punish.

Here's a hypothetical example. A 120-person logistics company launches a combined policy with a 30-day window. A sales manager reports that her team has been pasting call notes into personal ChatGPT accounts. The reviewer stops the practice, checks whether those notes held customer personal data, and either moves the team to an approved business account or declines the use. Nobody is disciplined for the report, and the company now knows about a workflow it had no way of seeing before.

Which option should you choose today?

Choose one document unless you already meet two of the conditions above. It's faster to publish, easier for employees to find and simple to split later. A separate shadow AI policy that nobody reads protects you less than one well-placed section that people use.

Whichever you choose, check these before you publish:

• An employee can find out what to do about an unlisted tool in under a minute.
• A named person or role owns tool review.
• Disclosure and concealment have visibly different consequences.
• Your approved list has one home and one owner, and both documents refer to it.

If you'd rather not assemble this yourself, you can generate a tailored policy kit and adapt it to your company.

About Shadow AI Policy: We build AI acceptable use policy tools for HR and operations teams at 50–500 person companies. We publish guides on shadow AI, acceptable use policies, and AI governance, updated as regulations and AI tools change.