The Tool List Was Out of Date by Friday: Write the Technology Ethics Policy Your AUP Can't

The views expressed are my own and do not represent those of my employer.

Imagine a finance analyst on a Friday afternoon. A supplier contract needs a summary by five. The approved AI tool is slow and caps file size. Her personal account on a public chatbot is already open in another tab. She pastes the contract in, gets a clean summary in seconds, and sends it to her director.

Depending on how your acceptable use policy is written, she may not have broken a single line of it. She also moved confidential terms into a service nobody vetted. And she never checked whether the summary got the termination clause right. It did not.

Now picture her colleague. He gives an AI agent access to his mailbox and calendar and tells it to clear his inbox. By Monday the agent has accepted a meeting, answered a vendor, and shared a folder. All of it happened under his credentials. Nobody told him which of those actions the policy forbade, because the policy only listed tools.

The Tool List Is a Snapshot. Conduct Is a Standard.

Here is the problem. Your acceptable use policy answers one question: which tools may I use? That question has a short shelf life. New tools appear weekly. Vendors switch on AI features inside software you already approved. Staff try things on their own phones.

The data says this is routine behavior, not a fringe one. Verizon's 2026 Data Breach Investigations Report, as summarized by Help Net Security, found that 45% of employees are now regular AI users in the workplace, up from 15% the previous year. It also found that 67% of users accessing AI on corporate devices were using non corporate accounts. Kiteworks, in its write up of the report, notes that the most common data type going into those services is source code. The report also ranks shadow AI as the third most common non malicious insider action in its data loss prevention data.

Non malicious is the phrase that matters. These are not rogue employees. They are people trying to get work done with tools that feel natural. A list cannot shape that behavior. Character and judgment can.

I covered the basics of AI policy back in February 2026 in Generative AI Policies: Aligning Organizational Governance with the NIST AI Risk Management Framework. If you are new to this, start there. This post picks up where that one left off. The data has moved, the regulators have moved, and agents have changed who is accountable for what a tool does.

An AUP tells people which tools they may use. A technology ethics policy tells them what kind of professional to be with any tool, including the ones nobody has approved yet.

I built a free Technology Ethics Policy template and published it on infosecmadeeasy.com. This post walks through each section of it and then through how to get it adopted. Take the template, change what your legal team tells you to change, and keep the structure.

Start With a Pledge, Not a Prohibition

Open the policy with a short pledge, two or three sentences, in the first person. Something like: I will use technology honestly, protect the information entrusted to me, and answer for what it does in my name.

Tie every sentence to a value your company already prints on its walls and its website. If the company says integrity, the pledge says honesty about when AI touched your work. If the company says customer trust, the pledge says protecting customer data from any tool, approved or not.

The tone matters more than most CISOs expect. A rulebook invites people to hunt for loopholes. A pledge invites them to see themselves as the kind of professional the policy describes. I would rather have a thousand people who signed a pledge than a thousand who skimmed a prohibition list.

Scope Has to Follow the Person, Not the Device

Purpose and scope is the section most policies get wrong. They scope to company systems. The behavior that hurts you happens at the edges, so the scope has to name the edges.

Personal devices. If work content touches a phone or a home laptop, the policy applies. Personal AI accounts. This is the strongest argument for the whole document. When two thirds of AI users on corporate devices sign in with personal accounts, your logging, your contracts and your data retention terms do not apply to that activity. The policy must say that conduct standards apply regardless of which account is signed in.

Third party and embedded tools. Include the AI feature a vendor turned on last quarter, the browser extension a contractor installed, and the meeting assistant a partner brought to a call. Staff are accountable for what they feed to these tools even though IT never deployed them.

The scope also covers contractors. That matches the direction regulators are taking. The EU AI Act's Article 4 literacy duty covers staff and other persons who use AI systems on the company's behalf, contractors included.

Five Obligations: Disclose, Verify, Protect, Report, Comply

This is the core of the policy. Five verbs, each one a duty a person carries into any tool. I keep them as verbs because people remember verbs.

Disclose. Say when AI materially shaped your work product. Tell the people who rely on it. Tell customers when a rule or contract requires it. Disclosure is not confession. It lets the reader apply the right level of scrutiny.

Verify. You own the output. Scale the checking to the consequence of the task. Light review for grammar and formatting help. Original source checking for research, because models invent citations with total confidence. Qualified review for legal, financial, medical or safety work, meaning a person with the credentials to catch the error signs off. The analyst in my opening scenario needed a lawyer to read that summary, or the contract itself.

Verification should scale with consequence. A grammar fix needs a glance. A contract clause needs a lawyer.

Protect. Treat confidential, personal, regulated and customer data as off limits to any service the company has not approved for that data class. Protect credentials and keys. Never paste secrets into a prompt.

Report. Tell the designated channel quickly when you see misuse, a leak, a wrong output that shipped, or an agent doing something unexpected. This obligation only works if reporting is safe, which I cover in the enforcement and playbook sections.

Comply. Follow the law and company policy that apply to your role and location. The policy does not recite those laws. It points to the people who track them.

Your Agent Acts Under Your Name

The prohibited conduct section ties to risk categories, not to tools. That is how it survives the next product launch. For each category, state the conduct and then state the accountability rule for agents.

Fraud and deception. No fabricated records, synthetic identities, impersonation, or deceptive content. The EU Digital Omnibus adds new prohibitions, applying from 2 December 2026, on AI systems designed to generate intimate images without consent or child sexual abuse material. Your policy should prohibit staff from producing that content with any tool, full stop.

Privacy. No feeding personal data to services without an approved basis. No using AI to profile or monitor colleagues, customers or candidates outside approved processes.

Unauthorized access. No pointing an AI tool or agent at systems, accounts or data you are not entitled to reach. No using an agent to bypass a control, even if it would save an afternoon.

Conflict of interest. No using company data or time to train, tune or run AI for outside work. No steering a business decision toward a tool you have a personal stake in.

Export controls. No sharing controlled technical data with foreign persons or unapproved AI services. I address the exact wording below.

Then add the sentence that matters most in the agentic era: a person is accountable for what their agent does under their credentials. If the agent acts as you, you acted. That rule closes the gap between a human decision and an autonomous action. It also gives the board a clean answer to a question it will ask. I wrote about that from the governance side in The Board Asked Who Owns That Agent. For the technical side, start with the inventory in You Can't Contain an Agent You Haven't Found. Controls constrain the agent. The ethics policy tells the human what they own.

Point to Legal. Do Not Restate the Law.

The multi jurisdiction section is where policy authors get ambitious and then get stale. Resist that. Name the regimes so staff know they exist: GDPR, CCPA, HIPAA, PIPEDA, LGPD, the EU AI Act and export controls. Then point to legal's current guidance for each. The policy states the duty to comply. Legal owns the detail.

Here is why that discipline matters. In the last few months, three of these moved.

The EU AI Act. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the Annex III high risk deadline to 2 December 2027 and the Annex I deadline to 2 August 2028. Annex III covers employment uses, so HR tooling is in that group. Staff literacy did not move. Article 4 now frames AI literacy as an obligation to take measures for staff, a more flexible wording than the original. The new text does not require a guaranteed level of literacy for any individual. The duty to act remains.

California. The CCPA regulations on automated decisionmaking technology took effect on 1 January 2026, with ADMT obligations applying from 1 January 2027. The word consumers carries a surprise for internal teams. Employees, applicants and independent contractors count as consumers under the CCPA, and employment decisions fall within the significant decision categories. An HR manager who lets a tool rank applicants is inside the rule. A business can stay outside the ADMT obligations by involving a human who reviews the output and has authority to change the decision. That is your verify obligation doing legal work. Confirm the exact test with counsel.

Export controls. This area keeps shifting, which is the best argument for not writing specifics into policy. BIS announced in May 2025 that it was rescinding the January 2025 AI Diffusion Rule, and Holland & Knight reported in June 2026 that no replacement rule had been issued. BIS guidance dated 31 May 2026 confirmed that a license requirement still applies to certain advanced computing items for entities headquartered in Country Group D:5 or Macau. A policy that cited one control number would already be wrong or soon will be. Write this line instead: Consult export compliance before sharing controlled technical data with foreign persons or unapproved AI services.

For GDPR, HIPAA, PIPEDA and LGPD, the policy line is the same: see legal's current guidance. I did not verify current status for those four in preparing this post, so check them with your counsel instead of taking a blog's word for it.

Concealment Is What Escalates

Enforcement needs three tiers, and the tiers must separate intent from outcome.

Tier one: honest mistakes. Someone pasted the wrong file, trusted a wrong answer, or tried a tool without asking. The response is coaching, retraining and a fix to the process that let it happen. If three people made the same mistake, the process failed, not the people.

Tier two: negligence and repeated carelessness. The person was trained, knew the rule, and kept skipping verification or ignoring data handling limits. The response is formal documentation, restricted access where appropriate, and a performance conversation.

Tier three: willful harm or concealment. Fraud, deliberate misuse, hiding an incident, deleting logs, lying in an investigation. The response is discipline up to termination, plus referral to legal or authorities when warranted.

The original error rarely ends a career. Concealment does. Write the policy so people know that before they decide whether to speak up.

This is just culture, borrowed from aviation and healthcare, applied to AI. If staff believe every mistake gets punished, they hide mistakes. Hidden mistakes become incidents. Build a safe harbor window: a defined period, I would start with five business days, in which a person who self reports a mistake is treated under tier one unless harm was willful. Put the window in writing. A promise that lives only in a manager's head will not survive the first test.

The Signature That Doubles as Evidence

Close the policy with an acknowledgment. Every person signs it. They renew it every year and again whenever their role changes, because a move into finance, HR or engineering changes which obligations bite hardest.

The signature does two jobs. It binds the person to the pledge, which matters when you reach tier two or three. It also produces records. Article 4 measures are expected to be documented, and the expectation is measures, not certificates. A dated acknowledgment, paired with training completion records, gives you evidence that you took measures for staff literacy. Ask legal whether the signature alone is enough for your situation. I treat it as one piece of evidence, never the only piece.

Make the acknowledgment short and readable. If it runs six pages, nobody reads it and the signature loses its meaning.

Exceptions: Say Yes Fast and Write It Down

Staff go around the policy when the approved path is slow. Your exceptions process is the pressure valve. It has four steps: request, risk review, time limited approval, and logging.

The request is a short form: what tool, what data, what task, what outcome. The risk review is proportionate. A tool that handles public marketing copy gets a quick look. A tool that touches customer records gets a deeper one. The approval carries an expiry date, so every exception returns for review. Every decision goes into a log, because that log tells you which tools your people actually want.

The promise to the business is speed. I recommend two business days for low risk requests and five for the rest. Track your time to decision and publish it. A fast no is better than a slow maybe, and a slow maybe is how shadow AI starts. I covered discovery in Shadow AI: What New CISOs Need to Do Before It Bites Them. The exceptions log feeds that work from the other direction.

A 30, 60 and 90 day rollout. In the first 30 days, draft from the template, get legal to mark up the jurisdiction and export language, and have HR draft the tiers. In days 31 to 60, stand up the exceptions process, run a pilot with two or three business units, and build the one page board report. In days 61 to 90, launch with the pledge, collect signatures, schedule the training, and publish the reporting path and safe harbor window. Review the whole thing at six months.

Getting Organizational Support: Every Level, Every Language

Each audience needs the same policy framed in its own terms. None of them wants to hear about prompt injection.

The board. Frame this as accountability and conduct risk. Directors already understand codes of conduct, conflicts of interest and expense policies. A technology ethics policy is the same kind of control for a new kind of tool. Bring one page of metrics: percentage of staff with a current signed acknowledgment, exception requests and median time to decision, self reports received, and enforcement actions by tier. Keep the page the same each quarter so trends show. Tell them the regulatory direction in plain words: regulators are moving toward holding organizations accountable for how staff use AI, and a signed, documented standard is the evidence.

Legal. Legal owns the jurisdiction list and the export language. Ask them to review quarterly and to tell you when something changes. The policy points to their guidance, so they control its accuracy. That arrangement usually earns legal's support, because nobody asked them to sign off on a list of laws that will be wrong by spring.

HR. HR owns the enforcement tiers and the acknowledgment. They carry the employment law risk, so the tiers must be theirs. Show them the tier structure and the safe harbor window early. They will have good edits, and they will defend the policy better when they helped write it.

Business leaders. Offer them the exceptions process and a service level for time to decision. Say plainly: you will get an answer in days, not months, and approved exceptions will be logged and renewed. Leaders support policies that speed them up. They resist policies that block them without explanation.

Employees. Lead with the pledge and a no blame reporting path. Explain the safe harbor window in the first all hands message. Say what happens to someone who reports a mistake in good faith, and say it in writing. Use a pledge first tone, not a rulebook tone. Ask managers to model it by disclosing their own AI use in front of their teams.

Key Points

• An AUP lists tools. A technology ethics policy sets conduct standards for any tool, including unapproved ones.
• Scope must cover personal devices, personal AI accounts, and third party and embedded tools.
• Five obligations: disclose, verify, protect, report, comply. Scale verification to consequence.
• Prohibited conduct ties to risk categories: fraud, privacy, unauthorized access, conflict of interest, export controls.
• A person is accountable for what their agent does under their credentials.
• Name the major laws, then point to legal's current guidance so the policy does not go stale.
• Enforce in three tiers. Concealment, not the original error, is what escalates.
• Collect a signed acknowledgment at hire, annually and at role change. Keep it as evidence of literacy measures.
• Run a fast exceptions process: request, risk review, time limited approval, log.
• Roll out in 30, 60 and 90 days with a pledge first tone.

Pro Tips

Read the pledge aloud to a skeptical engineer. If the engineer winces, the language is too corporate. Rewrite until a peer would say it without embarrassment.

Publish your time to decision. The exceptions metric does more for adoption than any training deck. When the business sees a median of two days, shadow requests drop because the official path works.

Reward the first self report. The first person who admits a mistake under the safe harbor window sets the tone for everyone. Thank them privately and, with permission, use the lesson in training without names.

Test the agent rule with a scenario. In training, walk people through an agent that sent something it should not have. Ask who owns it. The answer must be the person whose credentials it used. Let people argue it out, because the argument is how the rule sticks.

Put a review date on the policy itself. A conduct policy ages more slowly than a tool list, but it still ages. Calendar a yearly review aligned with the acknowledgment renewal.

Pitfalls to Avoid

Do not copy your acceptable use policy into the new document. The two have different jobs. If the ethics policy starts listing approved tools, you have rebuilt the problem.

Do not restate laws in the policy text. Statutes move, and your policy will contradict them within a year. Point to legal and let them own the facts.

Do not punish first reports. The fastest way to kill reporting is to discipline the first person who comes forward. Protect the safe harbor window even when the case is awkward.

Do not let the exceptions process stall. A queue that takes six weeks teaches people to stop asking. Staff the review and measure the clock.

Do not skip contractors and third parties. They use your data and your credentials. They sign the acknowledgment too.

Do not treat the signature as the finish line. A signed page without training, a reporting path and visible leadership behavior is paperwork, not a control.

Final Thought

Every tool on your approved list will be replaced, and every tool that is not on it is already in someone's browser, so the one control that outlasts both is the judgment of the person holding the keyboard, and your job is to shape that judgment before the next tool arrives.

If you build this policy at your organization, I would like to hear what changed and what your legal team pushed back on. Leave a comment, subscribe for the next post, or share this with a CISO who is still maintaining a tool list. Grab the free Technology Ethics Policy template on infosecmadeeasy.com and make it yours. I read every one.