You need an AI policy first, because it's quick to write and it protects you right away. But a policy is not a strategy. A policy sets rules for risk (security, privacy, compliance, safety) and should come from the top. A strategy gets people to change how they work, and that can't be ordered. It comes from ownership.
Too many organizations write a set of directives, call it their AI strategy, and wonder why nothing changes. The directives aren't wrong. They're just answering a different question. This post separates the two, shows which decisions belong to each, and explains why the strategy half is where most businesses get stuck.
What is an AI policy?
An AI policy is governance. It answers the questions where the right answer shouldn't depend on who you ask: what data may go into AI tools, which tools are approved, what has to be reviewed by a person before it goes to a client, and what happens when something goes wrong.
Those are things that help everyone but no one in particular. Security, compliance, privacy and safety don't make any one person's day better, so nobody will push for them on personal benefit alone. That's exactly why they should be set by rule and funded off the top. Waiting for staff to volunteer for data protection is not a plan.
Plenty of businesses don't have even this much. A 2025 global study by KPMG and the University of Melbourne found that only 40% of employees say their workplace has a policy or guidance on generative AI use.
What does a good AI policy cover?
For a business of up to 100 people, a good AI policy is short. It covers:
- Data: which kinds of information may go into which tools, and which never may (client confidential, personnel, regulated data).
- Tools and accounts: the approved list, and whether business or personal accounts are required.
- Requests: how to ask for a new tool, and how quickly you'll answer.
- Review: what AI-assisted work must be checked by a person, and by whom.
- Accountability: AI can be responsible for work, but never accountable for it. A named person owns every output that leaves the building.
- Incidents: what to do and who to tell if something goes wrong.
One or two pages is plenty. If people can't remember it, they won't follow it.
What is an AI strategy?
An AI strategy is a plan for how the work itself will change, who will change it, and what's in it for them. That last part is what most "strategies" leave out.
Here's the uncomfortable truth for leaders: the best change comes from individuals who drive it from the bottom up. A leader can't order someone to find a better way to do their job. A leader can only make it possible and worth their while.
That's what we mean by ownership. Ownership is agency plus incentives. Agency is the freedom and the time to change your own work. Incentives are a stake in what the change saves or earns: time back, recognition, a bigger role, pay. An admin assistant making $50,000 a year has no reason to do the work smarter if they get nothing from it. If the only reward for working smarter is more work, nobody changes.
Why isn't an AI policy the same as an AI strategy?
An AI policy and an AI strategy solve different problems, and confusing them is one of the most common reasons AI efforts stall in small and mid-sized businesses. A policy manages risk. It covers security, privacy, compliance and safety, and it should be decided from the top, applied to everyone, and funded centrally, because those protections help everyone but no one in particular. A strategy drives change. It decides how work gets redesigned, who does the redesigning, and who benefits, and it can't be decreed because people change their own work only when they have the agency to do it and an incentive to bother. A company with only a policy gets compliance: people follow the rules and keep working the old way. A company with only a strategy gets enthusiasm and risk. Write the policy first, because it's fast and protective. Then build the strategy, because that's where the return is.
Which AI decisions should be top-down, and which bottom-up?
Most of the confusion clears up when you sort the actual decisions.
| Decision | Top-down or bottom-up | Why |
|---|---|---|
| Which data may go into AI tools | Top-down | It's a risk decision. It must be consistent, and nobody should have to guess. |
| Which tasks to try AI on | Bottom-up | The people doing the work know where it hurts. Leaders don't. |
| The approved tools list | Top-down, with a fast request path | Security needs a list. A slow list sends people around it. |
| How a team redesigns a process | Bottom-up, with a leader's sign-off | The team knows the work; a leader checks it against risk and the rest of the business. |
| Who keeps the time saved | Leadership commits in writing | If people suspect the gain will be taken, they'll hide it. Only leadership can promise otherwise. |
| Which AI ideas get funded | Shared | Ideas come from staff; leaders decide quickly and give real reasons for a no. |
Notice the pattern. Leadership owns the guardrails, the resources and the promises. Staff own the ideas and the redesign. When leaders try to own the ideas too, they write directives. When staff are left to own the guardrails, you get risk.
What does a strategy have that a policy doesn't?
A policy tells people what they may not do. A strategy also tells them:
- Where to start. Not every role, everyone at once. A few processes, picked by the people who run them.
- When they'll get time. Protected time to learn and experiment, on the clock.
- What's in it for them. A written commitment about who keeps the time and money saved.
- How ideas get heard. A clear way to suggest a new tool or automation, and a quick answer.
- How quality is protected. Standards for review, so faster doesn't mean sloppier.
- How you'll know it's working. Changed processes and outcomes, not login counts.
That last point matters. Measuring logins instead of change is how companies end up paying for AI licenses nobody uses. And when ownership is missing, projects drift, which is one of the main reasons small business AI projects fail.
So which comes first?
Write the policy this month. Keep it short, make the request path fast, and make the safe option the easy one.
Then start on the strategy, and don't confuse it with a longer policy. At Mosaic, we work with leaders using three guiding rules for this part of the work, all built around the same idea: you don't have to deliver transformation yourself. You have to make it possible for your people to take part in it.
If you're a leader in Cedar Rapids, Iowa City or elsewhere in Iowa and your AI plan so far is a list of rules, our AI strategy and fractional AI leadership services can help you build the other half. Start with our Advise, Educate & Lead page.