Banning artificial intelligence looks like a control decision.
Often, it only makes its use invisible.
If a tool saves someone hours, a blanket policy rarely removes the incentive to use it.
What changes is that people stop talking about it.
Then the company loses exactly what it wanted to protect:
Visibility.
Judgment.
Traceability.
Some uses should be prohibited. Some data must not leave the company. Some decisions cannot be delegated. Some outputs always require human review.
But that requires distinguishing between risks, not treating every case as if it were the same.
A useful policy should answer three questions:
Where is it allowed?
Where is it not?
And where is it allowed only with review?
Governance is not saying no to everything.
It is making explicit the decisions that each person has been making on their own.