Most funds now have an AI policy. It was drafted in a hurry some time in the last eighteen months, reviewed by counsel, tabled at a partners' meeting, approved, and circulated to all staff with a request to acknowledge receipt. It names approved tools. It prohibits confidential information going into consumer services. It requires human review of outputs before external use.
It is, in most cases, a perfectly sensible document. It also controls nothing whatsoever.
We are not making a cynical point about corporate paperwork. We are making a specific operational one. A policy is an instruction to people about how they should behave when nobody is watching and they are under deadline pressure. A control is something that happens whether anyone remembers the instruction or not. Private capital firms are extremely good at building the second kind of thing everywhere in their business except this one.
Your firm already knows the difference, in every other domain
No fund relies on a policy document to stop money going to the wrong bank account. It relies on dual authorisation, callback verification and a payments system that will not execute a transfer to an unverified account however senior the person asking. Personal account dealing is not managed by a memo about conflicts; it is managed by a pre-clearance gate that blocks the trade. Restricted lists are enforced in the system that would otherwise permit the transaction.
In each case the firm concluded, correctly, that intent is not a control. The intent is written down because you need to be able to say what you were trying to achieve, but the thing that actually prevents the loss is a mechanism sitting in the path of the action.
AI usage has been treated as an exception to this reasoning, largely because the technology arrived faster than the control frameworks and because the initial risk assessment concluded that the exposure was reputational rather than financial. That assessment is becoming outdated. Once model outputs are informing valuation inputs, feeding investment committee papers and drafting text that reaches limited partners, the exposure looks like every other operational risk the firm already controls properly.
The gap widens exactly where the sanctioned route is slow
The thing a policy document cannot survive is a Tuesday afternoon with a Thursday deadline. An associate with 300 pages of a data room to summarise, a personal subscription to a capable consumer service and a sanctioned internal tool that is slower, worse and requires a request form will use the personal subscription. This is not misconduct in any meaningful sense. It is the predictable behaviour of a competent person who has been asked to produce work in a timeframe the compliant path cannot meet.
To put rough numbers on it, and these are illustrative rather than measured: on a 60-person firm where perhaps 35 people do document-heavy work, you might have a dozen individuals with personal AI subscriptions and no realistic mechanism for knowing what has been pasted into them. There is no log. There is no retention position. There is, in a genuine sense, no answer available to the question an investor might reasonably ask.
The practical test of any AI policy is therefore not whether it is well drafted. It is whether the compliant path is the fastest path. Where it is, adherence is close to automatic and requires no enforcement energy at all. Where it is not, the policy is a document describing a firm that does not exist.
Three controls do most of the work
The good news is that the control set is small and none of it is exotic. Logging comes first, because everything else depends on it. Every interaction with a model, made by anyone in the firm, recorded against a real identity, with the documents that were in context, retained under a stated policy and searchable after the fact. A useful log carries a few specific fields.
Who ran it, authenticated against the firm's own identity system rather than a tool-specific account.
What went in, including which documents were supplied as context and their classification.
What came back, retained in full rather than summarised.
What was done with it: discarded, edited, or used in a named deliverable.
Review gates come second. Not review of everything, which decays into rubber-stamping within a month, but a defined category of material output that cannot reach an external party without a named person signing it. Anything going to an LP, anything entering an IC paper, anything touching a valuation input. The gate belongs in the workflow, not in the policy, so that the reviewer is presented with the output and the source rather than being expected to remember that a rule applies.
Data classification comes third and is the one most firms skip, because it requires actual decisions. Which categories of information may be processed where: portfolio company financials, LP personal data, unpublished valuation work, deal documents under NDA. The classification is only a control when it is enforced by the connection between the model and the system of record, rather than by a person recalling which tier a document falls into at four in the afternoon.
Policy is genuinely necessary, and operational due diligence teams do read it
None of this makes the document worthless, and we would be arguing against ourselves if we suggested firms should stop writing one. Drafting the policy forces a firm to decide what it actually believes about a set of questions it has been avoiding: whether client data may leave the perimeter, who owns model outputs, what happens when an output turns out to be wrong. Those positions have to exist before any control can be built, because a control is the implementation of a decision and you cannot implement a decision nobody has made.
The policy is also the artefact that gets handed over. Operational due diligence questionnaires now routinely ask about AI usage, and institutional allocators are asking their managers to describe their approach in writing. A firm without a document looks unserious in a way that costs it real conversations.
What has changed is what comes next in that conversation. The first question is whether you have a policy, and nearly everyone can now answer it. The second question is what evidence exists that the policy is being followed. That question cannot be answered with another document. It is answered with a log, an access model and a sample of reviewed outputs, and a firm that has only written the policy discovers at exactly the wrong moment that it has nothing to show.
Auditable interaction is an architecture choice, not a feature added later
This is the point where the technology decisions stop being a procurement detail. Whether you can produce a complete, trustworthy record of how models have been used across your firm is determined almost entirely by how the capability was deployed in the first place, and it is very difficult to retrofit onto an estate of individual subscriptions and browser tabs.
It is one of the reasons our work is built on Anthropic's Claude. The enterprise deployment gives a firm a defensible position on data handling and retention rather than an assurance it has to take on faith. Interactions are attributable to real identities inside the firm's own directory, which is what makes a log worth producing. And the reasoning is visible enough to be reviewed rather than merely accepted, which matters for the review gate: a reviewer who can see how a conclusion was reached can form a judgement about it, while a reviewer handed only a conclusion is being asked to guess.
The connection pattern matters as much as the model. Where systems of record are reached through a declared interface, along the lines of the Model Context Protocol, the data boundary becomes an explicit property of the architecture rather than something a person has to observe. That is what turns data classification from a paragraph in a policy into something the system enforces on its own.
Build the control and the policy will describe something real
The firms making progress here have inverted the usual sequence. Rather than writing an aspirational document and hoping behaviour converges on it, they built a sanctioned path that is faster and better than the alternatives, instrumented it properly, and then wrote the policy as a description of what the system already does.
That inversion produces a document that is shorter, more specific and considerably more credible, because every clause in it corresponds to a mechanism someone can be shown. It also produces an operational due diligence answer that is an extract rather than an assertion. Over the next few years we expect that distinction to become one of the visible differences between firms that have adopted this technology seriously and firms that have adopted a position on it.
