Most US companies have AI policies. Very few have the infrastructure to enforce them. Here's the difference and how to close it before regulators do it for you.