Most companies can produce an AI tool policy on request: a list of approved platforms and a few rules about what’s off-limits. Far fewer can prove employees stick to it. Turning that list into evidence for a board, an auditor or a regulator is where AI tool governance actually happens.