Internal Usage Rules Alone Are Not Enough for AI Governance

Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.

When introducing generative AI, I expect some companies create an "AI usage policy" or "internal rules." A policy is one means of sharing the conditions of use within the company. However, from what I see in practice, I feel there is a risk in operating as if governance is complete once internal rules are in place.

The use of generative AI touches a wide range of areas, including information management, personal information protection, copyright and risk management by the board of directors. For this reason, the role of AI governance is not limited to deciding "whether AI may be used." It is the work of determining which information is handled, in which tasks, and under whose responsibility.

Situations That Internal Rules Alone Cannot Decide

When drafting a usage policy, it is common to see a list of prohibitions such as "do not enter confidential information," "do not enter personal information" and "do not accept outputs uncritically." These are clear as policies, but there are many situations in which they alone cannot fully support decisions on the ground.

For example, if someone wants to use AI to summarize a contract with a customer, its contents may constitute confidential information. In this case, the nature of the risk differs between an enterprise version under a company contract with training use turned off and thorough access management, and an individual entering the information into a free service. The lawfulness of entering the information and whether it is permitted under contract cannot be determined immediately from the plan name or the training-off setting alone. Check the actual contract terms and usage environment as well.

Whether the sales department is creating the outline of a proposal, the legal department is considering proposed clause revisions, or an engineer is conducting a code review, the issues to be assessed differ in each case. Precisely because each task carries different risks, usage rules must be built together with the actual workflows.

Input Information, Outputs and the Person Responsible

When designing AI governance, start by looking at the selection of input information. Personal information, trade secrets, unpublished financial results and the like have different impacts if leaked. For M&A and financing materials as well, check whether they can be handled on the same conditions as customer contracts and source code. Rather than lumping everything together as "confidential information," it is essential to classify information in light of the risk of a leak.

Next is the handling of outputs. Decide whether generated text, revised clauses and program code may be released externally as they are, who will review them, and which department will be responsible if there is an error. If use proceeds while this is left vague, convenience will run ahead, which may lead to unexpected trouble later.

The third point is where responsibility lies. Make clear whether the IT department has jurisdiction, whether the legal department is involved, or whether the head of each business division gives approval. Introducing AI affects not only working time but also information management across the entire company.

Contract Terms of External AI Services

In practicing AI governance, it is essential not only to prepare internal rules but also to examine the contract terms of the AI services being used. Check whether input data is used for model training and in which region it is stored. In addition to the scope of operation log retention and subcontractors, the allocation of responsibility in the event of an outage or information leak is also subject to review.

Particularly in work that handles customer information and contracts, consistency with confidentiality obligations owed to the counterparty becomes the focus. Check whether entering information received from others into an external AI would constitute a breach of contract, and whether it can be explained within the framework of outsourcing or subcontracting. When handling personal information, check not only whether the use constitutes entrustment but also whether the requirements for provision to third parties and transfers abroad are satisfied.

The terms of use of external services may also change. Rather than reading them only once at the time of introduction, setting up a practice of rechecking the terms of major services at milestones such as contract renewals and major updates makes it less likely that changes in conditions will be overlooked.

Designing Governance That Works on the Ground

AI governance creates standards that allow people on the ground to judge whether use is permitted. For tasks where prohibitions alone do not make the treatment clear, it is necessary to specify the conditions of use concretely.

In corporate legal practice, we indicate the tasks for which AI may be used and the information that may be entered, and decide the stages at which a person reviews the work. We check the business need and the risks and set out the conditions under which use is permitted.

At LegalAgent, we see AI governance as an effort that integrates "usage policies," "review of contracts" and "legal review workflows." I think it is important, even after a policy has been created, to check whether it can be used to make decisions in day-to-day work.