The fastest AI approval starts with a will-not list.
I run security for a regulated fintech. I am usually the person who says no to the AI pilot. So here is the fastest approval I can picture, from the other side of the table.
It starts with a list of what you will not do.
The will-not list
Three lines is enough.
- No customer data in week one.
- Nothing sent to a customer without a person reading it first.
- No new tool without telling security.
A short will-not list shows security you have already thought the way they do. Most pilots arrive as a list of what the tool can do. That is the wrong document. The reviewer is not asking what it can do. They are asking what it will not do, and whether you knew to ask.
The sentence that gets the no
Most of the no's I give are a no to one sentence: give AI access to our data.
That sentence is a request for everything. Swap it for four plain answers about what the job actually needs. Which data. For which task. Where it goes. Who can see the output. Nine times out of ten the job needs a small slice, and a small slice is easy to say yes to. I wrote this up in more detail in The data you never needed.
The policy that arrives late
The AI policy is still in review. The habits formed weeks ago. A long policy that arrives late teaches one lesson: the rule came after the use. People learn that rules are something that happens to them later.
Ship a one-page version this week. What is okay. What is not. Who to ask. Replace it when the long one is ready. That is exactly what I did inside my own company, and it worked better than the long document that followed it.
Why security says yes to this
Because it looks like what we would have written. A will-not list, a narrow data ask, and a one-page rule that already exists are the three things a reviewer would otherwise have to force out of you over six weeks of back and forth. Bring them on day one and the review is a conversation instead of a negotiation.
I am usually the person who says no. That is why I can get you to yes.
This is the kind of thing I help regulated companies with. See how the advisory works, or read The Boring AI Runbook.