AI usually gets into a business through ordinary work. Someone uses it to summarise a document, draft a first response, or search a large pile of material. A vendor turns on an AI feature that came with software the business already bought.
Each use case creates decisions about access, approvals, and accountability. For legal and technology teams, the job is to make those decisions visible before the tool becomes embedded in a workflow.
1. What AI tools are already in use?
Start with an honest inventory. Look beyond the tools that were formally purchased for the business. Ask about pilots, embedded vendor features, and the public AI tools people are using to get through their day.
For each tool, record its purpose, the data involved, the business owner, and the technical owner. You will quickly see which use cases need a closer look.
Once you know what is in use, you can set rules that reflect the way people actually work.
2. Can employees tell what they are allowed to do?
In May 2026, the PCPD published findings from compliance checks across 60 organisations. It called for internal AI governance structures, staff training, incident-response plans, employee policies, and ongoing review.
Use that as a prompt for the basics. Your policy should name approved tools, set limits on the information employees can enter, explain who can approve a new use case and tell staff what to do when they spot a problem.
The policy needs to be clear enough for someone to follow between meetings, with a client waiting for an answer.
3. Does an AI agent need a separate review?
Agentic AI can read files, call systems, and carry out multi-step tasks on a user’s behalf. That changes the access question.
The PCPD’s August 2026 guidance on agentic AI calls for minimum access rights, continuous risk assessment, human oversight where decisions affect individuals and clear responsibility for external providers.
Before an agent gets access to business systems, legal and technology teams need to check its permissions, data flows, supplier commitments and audit records.
4. Can the policy hold up in real legal work?
A policy has to work when a lawyer is researching an issue, reviewing a document, or drafting a first response.
That is where Lexis+ with Protégé fits. It brings legal research, document analysis, summarisation, and drafting into the same legal workflow, giving lawyers a clear route for using approved AI tools in day-to-day work.
5. Have you tested the wider governance questions?
Governed to Grow: AI Governance as a Foundation for Innovation was written for Australia, and its legal and regulatory material reflects that jurisdiction.
Use the paper to stress-test the questions that sit around a policy: who owns the system, how are decisions recorded, what should the board see, and where do supplier controls sit? These are the details that matter once AI moves from a policy document into daily use.
Complete the form below to download Governed to Grow: AI Governance as a Foundation for Innovation.
Note: The download will appear on this page after you submit the form. If it does not appear, please contact marketing.hk@lexisnexis.com.