Write your AI rules before you buy the tools, because your vendor already wrote theirs

Last Thursday, a federal judge in San Francisco temporarily blocked the Pentagon from labeling Anthropic a supply chain risk. The dispute began in contract talks. Anthropic wanted to keep its AI out of fully autonomous weapons and out of surveillance of Americans. The Pentagon argued it should be able to use Claude in any way it deems lawful.

I am not going to argue the policy question here. What interests me as an operator is how the fight started. A buyer and a vendor found out, after the software was already in use, that they disagreed about what it was allowed to do. If that can happen between the Defense Department and one of the largest AI labs, it can happen between your 80-person company and the tool your marketing team signed up for last month.

What the court actually decided

The Pentagon labeled Anthropic a supply chain risk, and President Trump directed federal agencies to stop using Anthropic and Claude. Anthropic sued earlier in March. According to Fortune, Judge Rita Lin blocked both the label and the federal ban, writing that the measures appear designed to punish Anthropic.

Her order takes effect after a one-week delay. It doesn’t require the Pentagon to use Anthropic’s products, and it doesn’t stop the Pentagon from switching to other AI providers. A separate, narrower case is still pending in the federal appeals court in Washington.

So the outcome for now is a legal pause, with the underlying question unresolved: who decides how an AI system gets used, the company that builds it or the organization that buys it?

Notice what both sides had in this fight. Anthropic had written down the uses it would not allow. The Pentagon had a clear position too: any lawful use. Whatever you think of either position, each side knew what it wanted before the argument started. Most companies buying AI tools today couldn’t say the same about themselves. If you asked the CEO of a typical 100-person company which uses of AI are off-limits in their business, I doubt the answer would come from anything written down. That gap is the problem worth fixing, and it is much cheaper to fix before a contract than after one.

Every AI tool arrives with someone else’s rules

That question isn’t limited to governments and frontier labs. Every AI product you buy comes with terms written by the vendor. They cover what you are allowed to use it for, what the vendor does with the data you put in, how long it keeps that data and what happens when you leave. Those terms reflect the vendor’s priorities. They were written before you showed up.

Most small and mid-size companies have no rules of their own to compare against. So the vendor’s terms become the company’s AI policy by default, one tool at a time, each with different terms. The sales team uses one tool, finance uses another, and a contractor uses a third on a personal account. Nobody can answer a simple question like “Is customer data going into any AI system, and which one?”

Before and after

Tools first

• Each team picks its own tool
• Vendor terms become your policy
• Nobody knows where data goes
• Rules come after a problem

→

Rules first

• One page of rules exists
• Each tool is checked against it
• Data limits are set in advance
• Problems are caught at purchase

What your one page should say

Your AI rules don’t need a lawyer or a committee. They need one page that a new employee can read in five minutes. I would cover six things.

What data can go in. Name the categories that never go into an AI tool without approval, such as customer personal data, payroll, health information or anything under a confidentiality agreement. Name what is fine, like public marketing copy or internal process documents.

What the tools may not be used for. Write down the uses that are off-limits for your company. For a staffing firm, that might be making final hiring decisions. For a clinic, it might be giving patients medical advice. Anthropic had two lines it wouldn’t cross. You should know yours.

What needs a person’s sign-off. List the actions an AI tool can’t take without a named person approving it: sending anything to a customer, changing a price, moving money, deleting records.

Who owns each tool. Every AI tool in the company has one owner who approved it, knows what it touches and answers for it.

What you tell customers. Decide whether and how you disclose that AI helped produce something a customer sees.

How a new tool gets approved. One short path: the person who wants it checks it against this page and the owner signs off.

ChecklistYour one-page AI rules

• Off-limits data is named
• Off-limits uses are named
• Sign-off actions are listed
• Each tool has one owner
• Customer disclosure is decided
• New tools have an approval path

Rules first changes how you buy

Once the page exists, buying gets simpler. You stop starting with a demo and start with a document. You send the vendor your page and ask them to show you, in their terms and settings, how their product fits it. Can you turn off training on your data? Where is it stored? Can the tool be limited to drafting, with a person sending? Can you see a log of what it did?

A vendor whose terms conflict with your rules is easy to spot at that stage. It is much harder to spot after six months of use, when a team depends on the tool and switching hurts. The Pentagon case is an extreme version of that late discovery. Most companies will never end up in court over it. They will just end up stuck with a tool whose rules they never read, or quietly breaking a promise they made to their own customers.

There is a second benefit. A written page gives your team permission to use AI with confidence. People avoid tools when they don’t know what is allowed, or they use them quietly and hope nobody asks. A clear page removes both problems, because the boundary is written down and the rest is fair game.

Your vendor wrote its rules before you showed up. Write yours before you sign.

What to do this week

1. Ask each department head to list every AI tool their team uses, including free ones and personal accounts used for work.
2. Draft your one page using the six headings above. Keep it to a single page and write it in plain sentences.
3. Pick one person to own the page and approve new tools against it.
4. Take your most-used AI tool and read its data and usage terms with the page beside you. Note any place they conflict.
5. Share the page with the whole company with a short note: this is what is allowed, this is what needs approval, ask the owner if you aren’t sure. Put a date on it and review it every quarter, because the tools will change faster than the page.

Do this before the next contract renewal or the next new subscription. Everything you buy after this week gets checked against your rules instead of setting them.

Sources

• Federal judge temporarily blocks the Pentagon from branding AI firm Anthropic a supply chain risk (Associated Press via News4JAX, March 26, 2026)
• U.S. judge blocks Pentagon’s ‘Orwellian notion’ to label Anthropic a supply chain risk and ban Claude from the government (Fortune, March 26, 2026)