A policy that nobody can test will not stop shadow AI
Firms often publish a broad ban or a broad permission statement and still cannot answer three operational questions. Which tools are approved. Who owns access when someone leaves. What test proves the policy is working.
Charlotte-area law firms and regulated teams that buy across North Carolina and South Carolina feel that gap when generative AI shows up inside research platforms, Microsoft 365, meeting tools, and endpoint agents at once. The job is an enforceable acceptable use policy, not a longer list of aspirations.
This guide is a technical and operational companion to policy work. It is not legal advice.
Start from realistic policy, not an untested ban
North Carolina lawyers can read 2024 Formal Ethics Opinion 1 (adopted November 1, 2024) with counsel. The opinion addresses professional responsibility when using AI in a law practice. Do not treat this article as an interpretation of competence, confidentiality, supervision, disclosure, or billing duties.
The NCBA Center for Practice Management also publishes practice-management commentary on why blanket bans can push use underground. See Beyond the Ban: Why Your Law Firm Needs a Realistic AI Policy in 2026. That article is educational commentary, distinct from the State Bar opinion. Use both as reading for counsel and firm leadership, not as a configuration checklist.
Charlotte buyers often span NC and SC: keep jurisdictions separate
Charlotte practices may serve clients or offices on both sides of the state line. South Carolina has an interim Generative AI policy for the judicial branch (March 25, 2025 order). That order applies to Judicial Branch officers and employees. It is not a blanket law-firm ethics mandate.
Do not transplant North Carolina conclusions into South Carolina work. Ask counsel which rules, opinions, and engagement-letter practices apply to each office and matter. Technical controls can be consistent across offices while legal interpretation stays jurisdiction-specific.
Test enforcement after launch, not the policy template
Use the AI acceptable use policy template for the document itself. The AI policy rollout guide covers introduction and adoption. This article starts after those steps, when approved users are already working.
To enforce an AI acceptable use policy, compare real use with the permissions the firm approved. A training completion record does not show whether users can bypass the boundary.
| Check after launch | Evidence to retain | Action when the check fails |
|---|---|---|
| Approved identities still match active staff | Access review and a sampled removal test | Suspend unexplained access while the owner investigates |
| Restricted inputs remain outside approved workflows | Synthetic boundary test and exception register | Pause the affected workflow if excluded data is reachable |
| Human review happens before external use | Sampled output with reviewer record | Hold further external use until review ownership is restored |
| Required events reach monitoring | Sample task and received events | Block expansion while visibility is missing |
Monitoring has limits. Document what the available identity, endpoint, or application evidence cannot show. Do not describe a browser restriction as proof that personal-device use has stopped.
Give exceptions an expiry date
An exception should identify the existing rule, the business reason for departing from it, and the person accepting the remaining risk. Record the affected users and data scope. Set an expiry date and the evidence required to renew it.
Keep the exception register alongside the enforcement findings. An expired exception is not standing permission. If a temporary allowance quietly becomes permanent, return it to the policy owner rather than leaving administrators to guess.
This is different from approving a new workflow. The workflow approval record handles that decision; this register tracks departures from rules already in force.
Decide consequences before the next bypass
Repeated bypasses need a response the firm has approved, not an improvised penalty from IT. Leadership, HR, and counsel should decide the appropriate response under the firm’s policies. Technical staff can preserve evidence and suspend the affected capability when authorized.
Distinguish an accidental upload from deliberate repeated use of an unapproved account. Record what happened, limit access while the issue is reviewed, and retain only the evidence the firm’s records rules permit. Avoid automatic disciplinary conclusions from a single alert.
Retest after remediation
Close a finding only when a repeat test supports closure. If a removed user still has access, a completed ticket is not enough. Check the session or grant that remained and document the result after correction.
Review recurring exceptions with the policy owner. Several requests for the same workaround may signal an unusable rule or a missing approved tool. That calls for a policy decision, not silent tolerance.
Quick answers
What makes an AI acceptable use policy enforceable after launch?
Compare real use with approved permissions. A training completion record does not show whether users can bypass the boundary.
What evidence should enforcement checks retain?
Access reviews and removal tests, synthetic boundary tests with an exception register, sampled output review records, and sample tasks with received monitoring events.
How should exceptions be handled?
Identify the existing rule, the business reason, the person accepting remaining risk, the affected users and data scope, an expiry date, and the evidence required to renew it.
When is an AUP not enforceable yet?
If access removal is unreliable or required monitoring events never arrive, pause expansion and name the policy owner, technical enforcer, and review date.
Close with ownership, not slogans
Name the policy owner, the technical enforcer, and the review date. Run the departure test before the pilot grows. If access removal is unreliable, the AUP is not enforceable yet.
Southeast buyers evaluating Claude Enterprise or Copilot-related controls can use the launch boundary in the Atlanta Claude Enterprise governance hub and the live Claude Enterprise deployment runbook for product-specific setup context. Keep policy enforceability separate from product marketing pages.
For a starting point, request the free AI Readiness Snapshot. It makes no changes to your environment and requires no software installation. Use the findings to see which policy statements the current tenant can support.
