AI Governance Best Practices: 10 Controls Enterprises Can Enforce Today
.jpeg)
The short answer
The best AI governance programs share one trait: every rule in the policy maps to a control that's actually enforced on the device. Here are the 10 AI governance best practices that matter most in 2026:
- Discover before you decide
- Separate personal from enterprise accounts
- Approve tenants, not domains
- Block uploads to personal accounts
- Inspect prompts and uploads, not just traffic
- Start DLP in Monitor mode
- Use Warn mode to coach
- Cover desktop apps and agents, not just browsers
- Make policy follow the device
- Review governance in minutes, monthly
1. Discover before you decide
Don't write policy from a vendor list. Write it from your own data. Turn on AI Usage Analytics in dope.console and see top AI applications, top users, and per-user breakdowns across your fleet. Most teams discover far more AI tools than IT approved, plus a long tail nobody knew existed. (Start here: how to see every AI app your employees use.)
2. Separate personal from enterprise accounts
The biggest AI risk usually isn't the tool. It's the account. A ChatGPT Enterprise workspace has admin controls and contractual protections; a personal free account has neither. dope.security's Shadow IT discovery shows whether AI access comes from a personal or corporate account, so you can size the problem before acting.
3. Approve tenants, not domains
Allowing chatgpt.com allows every ChatGPT account. Cloud Application Control lets you approve only your ChatGPT Enterprise workspace IDs and Claude Enterprise organization IDs. Non-matching requests are blocked. Enterprise access keeps working; personal accounts don't pass.
4. Block uploads to personal accounts
Sometimes you can't block access entirely, but you can stop data leaving. CAC supports blocking uploads from consumer accounts, including personal Google, Microsoft 365, and Box accounts, while still allowing access. (See blocking personal uploads with Cloud App Controls.)
5. Inspect prompts and uploads, not just traffic
Approved tenants still receive sensitive data. Dopamine DLP inspects prompts and file uploads on the device and classifies PII, PCI, PHI, and intellectual property by meaning, not regex. Coverage includes ChatGPT, Claude and the Anthropic API, Gemini, Perplexity, Abacus AI, Google NotebookLM, and Google Drive uploads.
6. Start DLP in Monitor mode
Blocking on day one creates tickets and workarounds. Run DLP in Monitor mode for two weeks, review detections and their Dopamine Summaries (plain-language explanations of why content was flagged), then move the categories you trust to Block.
7. Use Warn mode to coach
Gray areas deserve a nudge, not a wall. dope.security supports Block, Warn, and Allow in SWG policy with customizable Block and Warn screens, and CAC now supports Warn mode for Gemini and Copilot. A good warn page explains the policy and points to the approved tool.
| Situation | Recommended action |
|---|---|
| Approved enterprise AI tenant | Allow, with DLP on |
| Personal account on an approved AI tool | Block via CAC |
| Unvetted AI tool, low data risk | Warn and point to the approved alternative |
| Sensitive data detected in a prompt or upload | Block (after Monitor period) |
| Newly registered or unknown AI domain | Warn or Block by category |
8. Cover desktop apps and agents, not just browsers
AI runs in ChatGPT Desktop, Claude Desktop, IDE assistants, CLIs, and scripts. A browser extension can't see any of that. dope.security enforces at the operating-system level, so policy applies across browser and desktop app usage. Test your specific tools in a pilot, and document any bypasses for certificate-pinned apps. (See AI agent governance.)
9. Make policy follow the device
Governance that only works in the office isn't governance. dope.security's on-device enforcement applies the same policy on home Wi-Fi, in airports, and abroad, with no VPN hairpin and no cloud proxy detour. Policy changes push to every endpoint instantly.
10. Review governance in minutes, monthly
Governance decays without review. The Dopamine Assistant in dope.console turns monthly reviews into a conversation: ask "top AI apps by user last 30 days" or "users to investigate first by DLP violations," get answers in seconds, and export any table to CSV for your AI committee deck.
Put it in writing, then enforce it
Your AI acceptable use policy should mirror these controls line for line. Grab our free AI acceptable use policy template, then map each clause to a CAC rule, a DLP category, or a Warn page.
FAQ
What are AI governance best practices?
They're the controls that make an AI policy real: discovering AI use, approving enterprise tenants, blocking personal accounts, inspecting prompts and uploads with DLP, coaching users with Warn mode, and reviewing activity regularly.
Should we block ChatGPT?
Usually not. Block personal accounts and keep your enterprise workspace available. Blocking the tool pushes employees to unmanaged devices.
How often should we review AI governance?
Monthly at minimum, and immediately when a new AI tool shows up in your analytics.
Turn best practices into controls
Start a free trial and have practices 1, 2, and 3 live by the end of the week.
.jpeg)
.jpeg)
.jpeg)
