The provider’s rules on what their model may be used for, and your own rules for your staff. The first is a contractual constraint you inherit whether you read it or not; the second is the main practical control most organisations have. Both need to be specific enough to act on, which usually means naming permitted uses and data categories rather than issuing general warnings.
Technical view
Provider policies typically prohibit categories such as weapons development, targeted surveillance, generation of illegal material and certain uses in regulated decisions without human review, and they cascade to your end users, so your own terms need to carry them through. Internal policy should specify approved tools, data classifications permitted in each, requirements for human review by decision type, disclosure expectations and record keeping. Enforcement is a mix of technical controls and training; a policy nobody can follow while doing their job produces shadow AI rather than compliance.
Related
Part of AI Terminology Index, section: Governance, Law and Regulation.