When organizations first started formalizing AI policies, the problem they were solving for was narrow: keep employees from sharing sensitive data with a public model. A clear, manageable risk with a clear, manageable response.
What those policies didn't account for was how quickly AI would evolve, or how far the organizational guardrails would fall behind it.