Business Ethics for AI: What 10 S&P 500 Codes of Conduct Let Employees Do

We read the AI language in 10 current S&P 500 codes of conduct, and 4 of them make the same move: AI is allowed only inside tools the company has approved. That is the one place corporate business ethics on AI has converged. On everything else, from checking AI output to telling a client a draft was machine-written, the codes disagree or say nothing.

The short answer. Most S&P 500 codes of conduct that address AI let employees use it for ordinary work, but only through tools the company has approved. They ban putting company data into personal or public AI accounts. Few require human review of AI output, and none we read requires telling anyone that a piece of work was AI-generated.

How we read 10 S&P 500 codes of conduct

A code of conduct is the document every employee certifies each year. It is public, it is board-approved, and it is the closest thing a company has to a published statement of its business ethics. That makes it a useful place to see what a company is willing to commit to in writing about AI.

We read the current code for 10 companies in the S&P 500 index. For each one we recorded what the code allows, what it bans, what it requires employees to disclose or get approved, and whether it points to a separate AI policy. Everything below is from code text, not from responsible AI principles, supplier codes or press releases.

Which companies, and why these ten

The sample is deliberate, not random. It includes companies known to have revised their codes in 2025 or 2026, three large banks, two consumer technology companies, and two of the largest AI builders as a control. PulteGroup, a homebuilder, and CMS Energy, a utility, are there to show what AI language looks like outside technology and finance.

The ten are Microsoft, Alphabet, Amazon, Apple, Goldman Sachs, Bank of America, Morgan Stanley, Visa, PulteGroup and CMS Energy. Editions run from 2025 to July 2026. Where a newer edition existed but its AI text could not be confirmed, we say which edition we used.

What counted as an AI clause, and what we could not read

We counted any sentence in the code that names artificial intelligence, generative AI, large language models or a named AI product. A general rule about "approved applications" did not count unless the code tied it to AI. That is a strict test, and it lowers the count for codes that rely on older technology rules.

Several codes are published as large designed PDFs, and we could not extract full text from all of them. For Bank of America, Goldman Sachs, PulteGroup and Apple, parts of the AI sections came through in fragments. For Visa we confirmed that a new AI section exists but could not read its wording. We mark each gap in the comparison table rather than fill it.

Where corporate AI policy has converged: keep the data inside

The single idea every AI-aware code shares is containment. Company data may touch AI only inside systems the company controls. The codes phrase it differently, but the rule is the same, and it is the rule your own employee AI use policy should start with.

Approved tools only

Goldman Sachs states it most bluntly. Its code says "artificial intelligence, including large language models, can only be used in a manner approved by the firm through firm systems", and even then primarily for approved business purposes. The firm says it provides commercially licensed generative AI tools, subject to its risk management and governance review.

Morgan Stanley's 2025 code reaches the same place through an older rule. It already barred processing firm information outside firm-approved applications, and the 2025 edition extends that bar to anything outside firm-approved artificial intelligence applications. Bank of America's 2026 code tells employees to use only approved tools. PulteGroup requires preapproval by an internal AI Committee before any new AI tool is adopted.

Personal accounts are the named threat

The codes are specific about one failure mode: an employee pasting work into a personal chatbot account. PulteGroup's May 2026 code says "entering Company data into AI tools via personal or non-Company accounts is prohibited due to insufficient enterprise data protection". Goldman Sachs says access to public versions of tools such as ChatGPT, from firm or personal systems, is not permitted for business purposes.

Bank of America's January 2026 revision went further on scope. Its own disclosure page lists, among the changes, "the use of non-company-approved applications, third party websites or devices, including AI-enabled search engines". That last phrase matters. A search engine with an AI summary is now a disclosure channel in the bank's eyes. If your policy only names chatbots, it is already a year behind, a gap covered in more depth in the analysis of personal AI accounts as the new security perimeter.

The reason this rule converged first is not mysterious. It maps onto obligations these companies already had: client confidentiality, trade secrets, records retention. A bank does not need a new ethical theory to ban client data in a consumer app. It needs one more sentence in the confidentiality section. The cost of getting it wrong is measured in the breach cost data on shadow AI.

Where the codes still conflict on AI ethics in the workplace

Beyond containment, the ten codes split along three lines. These are not small drafting differences. They reflect different views of who the code is protecting and from what.

Builder rules versus user rules

Microsoft's Trust Code treats AI as something employees build. Under the heading "Develop and deploy Responsible AI", it asks staff to follow the Microsoft Responsible AI Standard and to report "Sensitive Uses to the Office of Responsible AI". It says nothing in the code about an employee using a chatbot to draft an email.

The banks take the opposite view. Their AI language is almost entirely about employees as users of tools, and almost silent on employees as builders. Neither framing is wrong. But a policy owner copying Microsoft's clause will cover product teams and miss the finance analyst. Copying Goldman's will cover the analyst and miss the engineer shipping a model.

My view: most companies outside technology should start from the user clause, because that is where 95% of their employees sit. Add a builder clause only when you ship AI to customers.

Naming brands versus naming categories

Bank of America names products, and its code shows what that costs. Its 2024 edition named ChatGPT and Google Bard as non-approved tools. The 2025 edition updated the list to ChatGPT and Google Gemini, because Bard no longer existed under that name. The 2026 edition names Microsoft Copilot among the company-approved generative AI chatbots that must not be misused.

Three rewrites in three years is the predictable result of naming brands. Product names change faster than codes are revised. Goldman uses a hybrid, naming ChatGPT only as an example of public tools. Morgan Stanley and PulteGroup name no products at all.

I would not copy the brand-name approach. Name the category, such as "public or consumer versions of AI tools", and keep the list of named products in an internal register that IT can update weekly.

Human review is the missing clause

Only two of the ten codes address checking AI output before it is used. Bank of America's 2026 code tells employees to maintain human oversight. PulteGroup's code appears to require review of AI output for bias, accuracy and appropriateness, though that passage was not fully legible in the published PDF.

The other eight are silent on it. That is the largest gap in the sample. A containment rule protects the company's data. A review rule protects the company's customers from a wrong answer sent under an employee's name. Our agent governance maturity model treats output review as a baseline control, and most of these codes have not reached it in writing.

The two codes that say nothing about AI

Alphabet and Amazon are among the largest AI builders in the world. Neither code mentions artificial intelligence, machine learning, chatbots or large language models.

The Google Code of Conduct was last updated on 16 July 2026, so this is not an old document nobody has touched. Amazon's Code of Business Conduct and Ethics carries no revision date on its page and also contains no AI language.

Silence is a choice, not an oversight. Both companies publish extensive responsible AI material elsewhere, and both run internal AI tool policies. Keeping AI out of the code keeps it out of the one document every employee certifies, and out of the one document a regulator or plaintiff will quote first.

I think that choice is defensible for a builder and wrong for almost everyone else. If your employees use AI daily and your code is silent, the gap between what staff certify and what they do grows each quarter. LRN found that only 53% of frontline employees hear about the code from their managers, against 85% of executives. A silent code reaches even fewer people on the topic they most need help with.

The AI code of conduct clause comparison table

This is the table policy owners asked for. Each row is one company's code. "Not seen" means the code text we read did not contain the clause. It does not mean the company has no such rule elsewhere.

Classification is ours, from code text only. Where a code points to a separate AI policy, that policy was not read and its rules are not counted. Morgan Stanley's 2026 edition was not confirmed to keep the AI wording, so the 2025 edition is shown.

Two patterns stand out. The densest AI language sits in regulated financial services and in PulteGroup, a company with no AI product to defend. The thinnest sits with the companies that build AI. Ethics language follows liability exposure, not technical sophistication.

CMS Energy is the most practical entry in the set. Its 2026 code summary says the recording conversations section was updated to cover the use of AI or any other system to capture meeting notes. It is a narrow rule attached to an existing one, and it addresses a real daily behaviour. The consent questions behind it are examined in the breakdown of AI note-taker consent and training rights.

Six employee AI use policy clauses worth borrowing

The table below takes the strongest version of each clause we found and turns it into wording a policy owner can adapt. The left column says where the idea came from. The right column says what to fix before you copy it.

Notice what is missing from the list. No code in the sample gave us an outward disclosure clause to borrow. If you want one, you are writing it from scratch. That is the subject of the evidence on whether AI disclosure helps or hurts customer trust, and it is the clause I would add first.

Keep the code short and put detail in the policy. Apple's structure is the cleanest model. The code states that Apple is "committed to the safe and responsible use of artificial intelligence", lists the interests at stake, and points to an AI Individual Use Policy for the operating rules. The code changes once a year. The policy can change monthly.

Where this comparison is weakest

Ten codes is not a sample of the S&P 500. It is a structured reading of ten documents, chosen partly because we expected AI language in them. Banks and payment companies make up 4 of the 10, so the containment finding is probably stronger here than across the index. LRN's figure of 15% of codes with AI guidance is the better estimate of prevalence, though it comes from a compliance vendor and covers global codes, not the S&P 500.

The bigger weakness is that code text is not the whole policy. Apple, Microsoft and PulteGroup all point to separate AI policies we did not read. Walmart's ethics site displays a notice that its search tool's use is governed by "Generative AI Guidelines", a document that sits outside the code. Alphabet and Amazon almost certainly have internal AI rules. Counting only code text understates what employees are actually told.

Text extraction left real gaps

Several codes are designed PDFs, and parts of their AI sections came through in fragments. Visa's new section could not be read at all. The human review findings for Bank of America and PulteGroup rest on partial text. Treat those two cells as likely, not certain, and check the source before quoting them in your own policy work.

Finally, a code is a statement of intent. Nothing in this reading shows whether any of these rules is enforced. A containment clause with no monitoring behind it is a sentence, not a control. Monitoring has its own legal limits, covered in the analysis of where AI employee monitoring crosses the legal line.

Frequently asked questions

Where to start with your own code

Pull up your current code and search it for three words: "AI", "artificial" and "generative". If all three return nothing, you are in the same position as Alphabet and Amazon, without their internal AI policy infrastructure behind you.

Then add one sentence before you add a section. Take the containment clause from the borrowing table, attach it to your existing confidentiality section, and name the internal page where the approved tool list lives. That one change covers the risk every code in this sample agreed on. The disclosure clause, the one none of them wrote, is your next decision.

Related reading