Why personal AI governance is becoming a credibility question for the professionals who advise on it

I’ve been noticing something that I think the AI governance community needs to talk about.

We spend a significant amount of time helping organizations write AI policies. We advise on acceptable use, design data classification frameworks, and build governance structures that tell thousands of employees what they can and cannot do with AI.

And most of us have never written those rules for ourselves.

I didn’t, until recently. I started thinking about it while drafting a video on this topic, and the realization was uncomfortable. I was advising organizations on something I hadn’t formalized in my own practice. Not because I was being reckless with AI, but because I’d never sat down and made the decisions explicit.

That distinction is important because most governance professionals are using AI thoughtfully. But thoughtfully and systematically are not the same thing, and the gap between the two is where credibility quietly erodes.

The Question Nobody Asks Directly

Nobody walks up and says, “What’s your personal AI policy?” because that phrasing would feel odd in most professional settings.

But I’ve started paying attention to how often the question shows up wearing a different hat. A client asks how you handle their data when AI tools are part of an engagement. A hiring manager asks you to walk through how you personally use AI in your own work. A vendor risk review form asks whether you use generative AI in delivering services and what oversight you have in place. Your CISO asks the governance team what controls they’re using personally before rolling out an enterprise-wide policy.

Each of these is the personal AI policy question, arriving in a context where improvising is costly. And I think the frequency is going to increase, not decrease. As AI use becomes more embedded in professional work, the expectation that you’ve thought about your own practice will become as basic as having a LinkedIn profile.

Why This Is a Credibility Issue

There’s a reason this hits governance professionals differently than it hits other roles.

If a marketing consultant uses AI without a personal policy, that’s a missed opportunity for trust-building. But if a governance professional does the same, it becomes a contradiction. We are the people who tell organizations that policies matter, that ad-hoc decisions create risk, and that “we’ll figure it out as we go” is not a governance strategy. If we can’t apply that logic to our own AI use, it raises a fair question about whether we believe what we’re advising.

That sounds harsh, and I don’t mean it as an indictment. I mean it as a recognition that the bar for us is different, and we should meet it.

Researchers at Candid wrote a piece earlier this year aimed at nonprofit professionals navigating AI use when their organization had no policy. Their core argument resonated with me: the absence of a policy isn’t the absence of responsibility. If the organization hasn’t drawn the line, that doesn’t mean there’s no line, it means the individual has to draw it.

That framing applies to governance professionals even more sharply, because we’re the ones who draw lines for a living. Drawing one for ourselves shouldn’t be the exception.

What I Think a Personal AI Policy Should Be

A personal AI policy is not a manifesto and it’s not a values statement you publish and forget. It’s a working document, one page, revisited quarterly, that captures the decisions you’ve made about how you use AI in your professional life.

It’s also not a shrunken version of a company policy. It’s actually a more specific one. An organization’s policy has to cover hundreds of roles and use cases, but yours only has to cover you, your tools, your stakeholders, and your judgment calls. That specificity is what makes it useful.

This also isn’t the same thing as AI fluency. Fluency is the skill of working with AI effectively, and personal governance is the rules you set for yourself. It’s where you operationalize your own professional ethics. Both matter, but they’re not the same thing.

Something I’ve Been Watching

Health content has had this figured out for years. You’ve probably seen the “Medically Reviewed by” byline on health articles, where a named professional with credentials signs off before publication. Finance content does the same thing with CFPs and CPAs.

That practice is starting to spread. PublishPress recently published guidance on adding “Reviewed by” credits to WordPress posts, which is a signal that the expectation of human review on AI-assisted content is moving from healthcare into broader professional publishing.

I think this trend has implications for anyone producing content that shapes decisions, and that includes governance professionals. If the work you publish influences how people think about risk, compliance, or career strategy, the question of who reviewed it before it went out is not academic.

I’m working on this in my own practice. In my research life, there’s a clear, rigorous, peer-reviewed process that ensures quality. For my non-academic work, which includes videos, blog posts, and educational materials, I’m thinking carefully about what a “reviewed by” step looks like. I’m starting by importing what I’ve learned from academic life, which means verifying every source and every citation and thinking carefully about the words I choose. I’m not there yet, but I’m on it.

Others Are Already Doing This

What surprised me when I started researching this topic is who’s already publishing personal AI policies.

Marketing consultant Susan Jensen has a twelve-point personal AI policy on her website that covers data confidentiality, source verification, model bias awareness, and the commitment that client work is never used to train public models. Editor Suzanne Arnold publishes her own AI policy detailing how she handles client text and what she’s actively experimenting with. And Susan Finch Solutions publishes a seven-section responsible AI use policy that names the tools used and invites client questions.

These aren’t governance professionals. They’re a marketer, an editor, and a solutions consultant, and they’ve already done the work that most of us in governance haven’t.

What their pages share is that they’re dated, written in first person, specific about tools and tasks, honest about what they’re still figuring out, and they invite questions. None of them read like legal documents. They read like professionals being transparent about how they work.

If professionals outside governance have published personal AI policies, I think the case for governance professionals doing the same is difficult to argue against.

The Over-Reliance Question

There’s one more dimension to this that I think is under-discussed.

My co-authors and I are currently working on a study on AI over-reliance, looking at its determinants and consequences. I’ll share more when we’ve finalized the interpretation of our results, but what I can say now is that being mindful of the extent to which we depend on AI, and naming what should stay human-led, is going to become a significant area of both professional practice and academic inquiry.

A personal AI policy is one practical way to engage with that question, not at the theoretical level, but at the level of your own daily practice. What stays human? What judgment calls do you protect? Where is the line between AI assisting your thinking and AI replacing it?

Those aren’t abstract questions. They’re professional ones, and having written answers matters.

Where to Go From Here

I released a video this week walking through a four-pillar framework for personal AI policies that covers Principles, Data Rules, Verification, and Boundaries. I also put together a free one-page template you can fill in directly, and both are linked below.

The framework is intentionally simple. The hard part isn’t the structure. The hard part is being honest about what you’re actually doing and whether it matches what you’d advise a client to do.

I’m still refining my own, and that’s the whole point. A working document isn’t a finished one, whether it belongs to an organization or to an individual.