The proliferation of generative artificial intelligence (GenAI) in the workplace raises critical questions on how to regulate these technologies within organizations. GenAI technologies generate excitement but also present significant ethical and legal issues, compelling organizations to self-regulate in the absence of comprehensive governmental regulations. Although the emerging field of regulation and information technology (IT) provides a foundation for exploring rulemaking in relation to new technologies, the unique trajectories of GenAI remain underexamined. Through a field study of a leading European business school, we trace how an organizational group without technological expertise assumed responsibility in this context. Our preliminary findings reveal how rulemaking around GenAI evolved through the contingent interactions between practices, rules, and technology, where rule-makers transitioned from preventing unwanted uses by “copying” existing regulations to crafting distinct, tailored rules and finally facilitating learning to promote new, wanted uses. Throughout this journey, the rule-makers grappled with the challenge of regulating an emergent technology for which they lacked initial expertise and the envisioned usages and risks were constantly shifting.
