How to create an AI creative policy that works... and is followed

Organisations in every sector are moving quickly to leverage the power of artificial intelligence and large language models (LLMs), but they also need to be putting in place effective risk management strategies and policies to govern this new technology.

Indeed, many companies are already doing this, with a 2026 study conducted by Santa Cruz Software finding that 96% of organisations have AI restrictions in place.

However, although businesses are attempting to control AI use by their employees, they’re failing: the same study found that, although 96% of organisations have AI use policies in place, 96% of employees are finding ways around them, leading to the rise of ‘Shadow AI’.

It’s not enough for you to create an AI policy that makes sense — you also need to make sure that it’s being followed.

READ MORE: The ethical implications of AI and how organisations can use it responsibly

What is Shadow AI?

Shadow AI refers to the use of AI tools and LLMs without the knowledge, approval or oversight of the organisation. This isn’t necessarily malicious or deliberately deceitful, and there are three main reasons an employee might seek out an AI tool themselves to complete a task:

• To complete an arduous task quicker, potentially as a result of workplace pressure caused by workload or tight deadlines.
• To work on a task they lack the technical ability to complete.
• They don’t know about a specific AI restriction because of a lack of awareness or a lack of training.

This is made even harder to stay on top of because of how quickly new AI tools are being developed: the challenge is for organisations to create comprehensive policies that don’t become outdated within months.

Why is Shadow AI a critical issue?

You need to gain control of Shadow AI, not because AI content is increasingly unpopular, but because it has the potential to break the digital asset supply chain.

It destroys visibility and traceability

Shadow AI usage creates gaps in your organisation’s digital supply chain, eroding asset visibility and traceability. Consider the following asset workflow:

1. An employee downloads an image from the DAM.
2. That image is processed through an external AI service, for example ChatGPT or Claude, to remove a background, remove a person or object, or other edit.
3. The employee uploads the image back into the DAM library.

When this happens, essential information can be lost. This new version might not contain the original metadata, provenance information, usage rights or version history, making it hard to establish which tool changed it, what was edited, and whether the new version is approved for use.

Compliance and adhering to consent restrictions is harder

This workflow creates a governance risk even if the employee isn’t trying to get around AI restrictions. If you cannot see where an asset has been or how it has changed, you cannot reliably manage its permissions, compliance or lifecycle.

The problem is that generative AI models work by recognising visual patterns and predicting likely outputs, not by understanding the legal and contractual rules attached to an asset. An AI model can recognise a particular product, place or person in an image, but it can’t know whether there’s an embargo in place, whether the person pictured has consented to commercial use, or whether distribution and publication rights are restricted to certain regions.

These restrictions are defined by documented permissions and consent records, but this information can be lost if an image is processed by an external AI tool. This makes it much easier to publish an asset in a format or location that breaches those restrictions, exposing the organisation to potential legal and reputational risks.

How to solve the Shadow AI problem

Fortunately, the Shadow AI problem can be solved by an AI creative policy that can keep up with the pace of change, and that’s followed by your employees.

Move beyond written documentation

Documented AI policies have a part to play in tackling shadow AI, but organisations need to go much further to ensure employees don’t continue to use restricted AI tools and processes. As is the case with any other policy, the presence of written documentation isn’t evidence those policies are being followed.

To be effective, AI governance has to be engineered into the asset lifecycle and where the work is actually taking place. Practically speaking, this means integrating the DAM system with the tools creative teams are using every day, for example the Adobe Suite and stock image libraries. 

These integrations significantly reduce the need to download files onto local machines, outside of the DAM Manager’s oversight, and make it much easier to control the digital asset supply chain. What’s more, the edited files can be reuploaded into the DAM with the full metadata, consent information and asset audit trail in place.

Adopt a positive cyber security culture

Your organisation needs to view cyber security as a collective and collaborative effort, rather than a set of rules and restrictions which simply make their jobs harder. 

The benefits of implementing a positive cyber security culture include:

• Employees are more likely to identify potential problems and suggest ways processes can be improved.
• People feel they can communicate openly about issues, and that their feedback and concerns will be received positively.

The follow-on effects of this positive culture is that employees are less inclined to find workarounds for inefficient processes, or use tools that fall outside of the organisation’s IT ecosystem.

READ MORE: Using AI for content generation? Here's how to do it right

ResourceSpace is a modern DAM system that embraces AI technology, without compromising the digital asset supply chain or your privacy and compliance obligations. Our integration with GPT empowers customers to streamline their asset workflows with metadata automation.

To find out more about how ResourceSpace’s implementation of AI technology can actually reduce the proliferation of shadow AI in your organisation, book your free Digital Asset Management demo by following the link below.