I have to share this somewhere or my brain might pop and ooze out my ears. Just released our first company AI policy last Thursday. No draconian stuff other than "don't run any Gen AI code on company machines without running it past IT first". The rest is common sense stuff like misrepresenting AI work as your own (you can use it to help, but don't claim credit if AI did the actual work), no PII info, verify results, etc. I even ran it past our key AI users for feedback and got some good feedback that helped complete the 1.0 version. I kid you not, I just got back pages of 'suggestions' from one of the reviewers. Not bad in itself, but here's how it starts:

Hi Mark,

I ran the AI policy through GPT5-Thinking. Here is the feedback it provided. All feedback includes citations in case you'd like to dig into anything further. I've also attached a redlined version of the policy to this email for you and the rest of the team to read through.

Gen AI to evaluate a Gen AI policy. I won't share the content, but it's... interesting.