An AI tool now sits on many desks in a garment business without anyone deciding it should be there. A merchandiser pastes a buyer's email into an AI tool to draft a reply. A costing clerk asks an AI tool to check a calculation. A planner uses one to summarise a tech pack. Each use feels small and helpful on its own, and each one is also a business decision about what leaves the building, what a customer receives in the business's name, and who is responsible if the AI tool is wrong.
This lesson gives you the reasoning for writing a short, workable policy that says which AI tools staff may use, what information may and may not be given to them, and when a person must check the output before it reaches a buyer, a factory floor or a shipment document. This lesson mainly teaches the decision flow: who decides, on what basis, before an AI tool is trusted with real business information. Without a policy, the rule that actually applies is whatever each individual person decides for themselves, which is not a rule at all.
You need: a basic understanding of an order record and the main functions in a garment factory or buying office. Track 17 on data governance is useful preparation, since an AI-use policy extends the same ownership and access thinking to a new kind of tool.
By the end of this lesson you can:
Not covered here: how to evaluate a specific AI tool before buying it (Lesson 5.3), the risks an ungoverned tool creates in practice (Lesson 5.2), and how to assign accountability when AI-assisted work goes wrong (Lesson 5.4).
| Term | Meaning |
|---|---|
| AI tool | Any software that generates, drafts, summarises, calculates or recommends using artificial intelligence, whether built into another system or used on its own. |
| AI-use policy | A business's own written rule for which AI tools staff may use, what information may be given to them, and when a person must review the output. |
| Confidential information | Business information a company has agreed, by contract or by its own rule, not to share outside the people who need it to do their job. |
| Human review | A named person checking an AI tool's output against the facts before it is acted on or sent to anyone outside the business. |
| Shadow use | An AI tool used by staff for real work without the business's knowledge or approval. |
An AI tool is not a neutral piece of office software. It can read and remember what is typed into it, it can produce a confident-sounding answer that is wrong, and it can act in the business's name faster than any single person could. A written policy turns three separate risks (a leaked specification, an unchecked error, an unclear responsibility) into three separate rules a staff member can actually follow: which tools are approved, what may and may not be entered into them, and which outputs need a named person's review before they are used.
Without a policy, staff make each of these three decisions alone, differently, every time, based on whatever seems convenient that day.
| What can differ | The shapes you will meet | Why it matters to you |
|---|---|---|
| Export order under Make to Order | An export factory's staff often paste a buyer's own confirmed price, quantity or specification into an AI tool to draft a reply or a summary. | That information is the buyer's own confirmed commercial fact; a policy must say clearly whether it may leave the business's own systems at all, and in what form. |
| Domestic replenishment under Make to Stock | A domestic brand's planning team may ask an AI tool to help read its own sales history or forecast, information the business itself owns outright. | Even information a business owns needs a rule, because a wrong AI-drafted forecast used without review still costs real stock and cash. |
| Hybrid order handled through a mill | A mill working on a hybrid mix of order types may use an AI tool to help draft a material specification shared across more than one buyer's order. | A specification error copied across several orders at once is a larger, faster-moving mistake than the same error made once by hand. |
| Buying office or agent role | A buying office often holds confidential information from more than one buyer at the same time. | An AI tool used carelessly by one person can mix information that must legally and commercially stay separate between buyers. |
| Different product families | Socks, knit-to-garment, terry and home-textiles businesses all use AI tools the same general way, for drafting, summarising and calculating; only the specific documents at risk change. | The policy's three rules (approved tools, information rule, human review) apply the same way across every product family. |
Northline Apparel has confirmed Order A with Delta Garments: 15,000 T-shirts, single jersey 180 GSM, Ne 30/1, agreed FOB USD 3.20 per piece, total order value USD 48,000. Mona, the factory merchandiser, discovers that two members of her own team have already been using a general-purpose AI tool to draft replies to Northline Apparel and to summarise tech pack pages, without anyone deciding this was allowed.
Mona does not ban AI tools outright, because she can see the drafting help is genuinely useful. Instead she takes the question to Delta Garments' management and writes a short policy: one AI tool is named as approved for drafting text; Order A's confirmed price, quantity and any unreleased specification detail may not be typed into any AI tool, approved or not, because that information belongs to Northline Apparel under the order agreement; and any AI-drafted reply that mentions a price, a date or a quantity must be checked by Mona herself against the confirmed order record before it is sent.
Karim, the production manager, asks whether this means his team cannot use AI tools for anything. Mona explains that a general question, such as asking an AI tool to explain a fibre property, carries no business risk and needs no review; the rule applies specifically to information from Order A and to anything sent to Northline Apparel in the business's name.
The worked numberSuppose a team member, before the policy existed, had asked an AI tool to draft a reply to Northline Apparel confirming a revised delivery week, and the AI tool had guessed a week instead of checking the confirmed production plan, understating the delay by one week.
The whole order's value is at risk from one unreviewed sentence, not because the AI tool is unusually dangerous, but because nothing stood between its guess and a commitment made in Delta Garments' name to Northline Apparel. A single human review step, costing a few minutes, would have caught the wrong week before it was sent.
That assumption feels safe because no manager approved anything, so it feels like no one can be blamed. It becomes expensive the moment an AI-drafted document reaches a buyer or a factory floor with a wrong figure in it, because by then staff have already been using AI tools without a rule for months, and there is no record of what was checked and what was not.
The better rule is simple: write the policy as soon as one person is found using an AI tool for real work, not after something goes wrong.
An AI tool is like a very fast, very confident new assistant who has never seen your order file and does not know what is confidential. Before you let that assistant answer on your behalf, you decide which jobs it may help with, what information it is never shown, and who checks its work before it goes out the door.
Write that down once, in a short policy, and every person in the business can follow the same rule instead of guessing their own.
A trainee, three weeks into the merchandising team at Delta Garments, is asked to summarise Order A's latest specification update for Karim's production meeting. To save time, the trainee pastes the full specification, including the unreleased construction detail Northline Apparel has not yet approved for wider circulation, into a public AI tool to get a quick summary.
Should the trainee's summary be used for Karim's meeting as it stands? Decide before opening the answer.
No. The summary is not used until the specification is re-summarised without the AI tool, and Mona is told what was entered.
1. The unreleased construction detail is confidential information under the order agreement with Northline Apparel, and pasting it into a public AI tool is very likely a breach of that confidentiality, whether or not the trainee understood this. 2. No policy told the trainee what was off limits, which is the missing control, not an excuse to use the AI-generated summary anyway. The absence of a rule does not make the information any less confidential. 3. Mona must know what was entered so she can judge whether Northline Apparel needs to be told, since the business cannot manage a risk it does not know exists.
The cost of using the AI-generated summary anyway is not only a possible breach of Order A's own confidentiality; it is that the business would have no record of what left its systems, which makes the next mistake just as likely as this one.
Order A's fixed total order value is a simple reminder of what one breach or one unreviewed error can put at risk:
An AI-use policy itself costs a few hours to write and almost nothing to maintain. What it protects is not only Order A's own USD 48,000, but the trust a buyer places in every future order once one AI-related mistake, large or small, has already happened. A confidentiality breach or a wrong AI-drafted commitment rarely shows up as a single clean number on a cost sheet; it shows up as a buyer asking harder questions on the next order, or asking for it at all.
The cheapest point to prevent that cost is the policy itself, written once, before an AI tool has already been used on real business information.
Use the T18-C05 AI governance and risk checklist workbook. In the AI tool inventory sheet, list every AI tool currently used across the business, who uses it, what kind of information is entered into it, and whether it is approved. Start with Delta Garments' own two AI-drafting uses on Order A, then repeat the exercise for your own business.
[Download the AI governance and risk checklist workbook](../../templates/T18-C05-ai-governance-and-risk-checklist.xlsx)
1. Why does Mona's policy allow a general question to an AI tool, such as asking it to explain a fibre property, without requiring review, while requiring review for anything mentioning Order A's price, date or quantity?
2. Order B (3,000 jeans, agreed target FOB USD 9.80 per piece) has 2 weeks of production remaining when an unreviewed AI-drafted reply understates a delay by 1 week and is sent to the buyer. What value does this put at risk on the order?
| EN | AR | FR | TR | Meaning |
|---|---|---|---|---|
| AI tool | أداة ذكاء اصطناعي | Outil d'IA | Yapay zekâ aracı | Any software that generates, drafts, summarises, calculates or recommends using artificial intelligence, whether built into another system or used on its own. |
| AI-use policy | سياسة استخدام الذكاء الاصطناعي | Politique d'utilisation de l'IA | Yapay zekâ kullanım politikası | A business's own written rule for which AI tools staff may use, what information may be given to them, and when a person must review the output. |
| Confidential information | معلومات سرية | Information confidentielle | Gizli bilgi | Business information a company has agreed, by contract or by its own rule, not to share outside the people who need it to do their job. |
| Human review | مراجعة بشرية | Révision humaine | İnsan incelemesi | A named person checking an AI tool's output against the facts before it is acted on or sent to anyone outside the business. |
| Shadow use | استخدام غير معلن | Usage non déclaré | Gölge kullanım | An AI tool used by staff for real work without the business's knowledge or approval. |
Next you will see, from a buyer's own side, what actually goes wrong when a factory or buying office lets staff use an AI tool with no policy at all. Back to the course map