Goldman Sachs AI policy: build the tool first

September 1, 2026 · 5 min · Free, with full transcript

Why do most corporate AI policies change nothing, and what did Goldman Sachs do differently? The position here is that a ban you cannot detect is only a suggestion. Goldman put its GSAI Assistant in front of roughly 46,000 employees by early 2026, ran the model inside its own environment so sensitive data stayed in, then wrote rules that described how the tool already worked. You come away with the sequence to copy: capability first, policy second. The episode covers tiered permission by data sensitivity and human review, why shadow AI disappears when the compliant tool is the easiest one, the cost of deliberately slow pilots, and a fast lane for new use case requests.

Listen to the podcast

4 min

Chapters

Key takeaways

  • Give people one approved AI tool before writing any policy, then write rules that describe what you observed.
  • Make the sanctioned tool the easiest path so employees have no reason to smuggle in ungoverned shadow AI.
  • Tier tasks by data sensitivity and whether output reaches a human first, so strict controls feel earned rather than arbitrary.
  • Require a named person to sign off on anything touching client money or regulated advice.
  • Keep a request path for new use cases that answers in days, not a committee that meets quarterly.
Read the full transcript

Host:Welcome to the Leaders' Insights podcast. Today's episode, how Goldman Sachs built an AI usage policy that employees actually followed. Most companies have an AI policy nobody reads. Goldman Sachs claims theirs actually changed how people work. Why should I believe that isn't just a press release?

Expert:Because the evidence is in the usage numbers, not the pros. By early 2026, Goldman had their internal assistant, they call it GSAI Assistant, in the hands of roughly 46,000 employees. When adoption is that broad, the policy isn't decoration, it's load-bearing.

Host:Fine, but adoption isn't compliance. Plenty of people use tools while quietly breaking every rule attached to them.

Expert:Right, and that's exactly what most firms get wrong. They write a policy as a list of prohibitions, don't paste client data, don't use unapproved tools, and then act shocked when it's ignored. A ban you can't detect is a suggestion. Goldman flipped it. Instead of telling people what not to do outside the walls, they made the sanctioned path the easiest path.

Host:Meaning what concretely?

Expert:Meaning they built the guardrails into the tool itself. The assistant runs inside their own environment, so sensitive data never leaves. If the only good AI on your desk is the compliant one, you don't need a 30-page document policing shadow AI. The ungoverned tools employees smuggle in on their own.

Host:That sounds convenient for Goldman. They have a few billion dollars to build in-house. What's a normal company supposed to do with that lesson?

Expert:The transferable part isn't the spending, it's the sequence. Most teams write the policy first and build capability never. Goldman gave people a real tool, then wrote rules that matched how the tool actually worked. The rule was legible because it described reality. That costs judgment, not money.

Host:Let me push on the employees actually followed claim. Financial firms are terrified of regulators. Isn't fear doing the real work here, not clever policy design?

Expert:Fear gets you performative compliance, people who technically obey, and quietly resent it. That's how you get a workforce that stops volunteering the risky but valuable use cases. What Goldman did differently was tiered permission. Not every task carries the same risk, so they didn't govern them identically. Summarizing a public earnings call is not the same as drafting client-facing advice, and treating them the same is how you train people to ignore you.

Host:Give me the mechanism. How does a bank decide which task sits in which tier?

Expert:They classify by data sensitivity and by whether output goes to a human first. Internal research summary, low stakes, wide access, anything touching client money or regulated advice, tighter controls plus a human review step, a person signs off before it goes out. The genius is mundane. Employees can see why the strict cases are strict, so the strictness feels earned rather than arbitrary.

Host:You keep praising Goldman. What did they get wrong?

Expert:They were slow, deliberately, and that annoyed people internally. They ran controlled pilots with their engineers and select teams before the wide rollout, which meant plenty of staff watched competitors move faster and felt left behind.

Host:I'd argue that's a feature. A policy nobody's tested is a rumor with a logo, but it's a real cost, and anyone copying this should expect the impatience. Isn't there a risk the whole thing becomes a comfortable cage? People only think inside the sanctioned tool and stop exploring?

Expert:That's the honest danger, yes. This can calcify into a place where good ideas go to fill out a form. The counter is to keep a fast lane for proposing new use cases, a request path that gets answered in days, not a committee that meets quarterly and adjourns before deciding anything.

Host:So if I run a midsize team and I want one thing I can do Monday, what is it?

Expert:Stop writing the policy first. Pick one approved tool. Put it in front of people. Watch how they actually use it for two weeks. Then write rules that describe what you saw. People only think that a policy should document reality, not fantasize about it. A rule people recognize is a rule people keep. Describe the terrain before you draw the map that I can use.

Host:That's your five. The full AI track, structured no fluff, is at MBA-training.com.

Read and go deeper