Does your workplace have an actual policy on which AI tools you're allowed to use?

Genuinely curious how common this is right now.

Some companies have a clear, written policy: these AI tools are approved, these aren't, here's what you can and can't feed into them. Others have no policy at all, so people just quietly use whatever tool gets the job done fastest.

If your workplace does have a policy, was it something IT/security rolled out proactively, or did it only show up after something went wrong? And if there's no policy, does that worry you, or does it just not come up?

Asking because AI governance is moving fast and I think a lot of organizations are improvising more than people realize.