AI Policy
An AI policy your people can follow.
A policy only works if your people can act on it. The test is simpler than it looks: can one of your team tell, without asking, whether pasting a client document into a chat window is allowed? If not, you have a statement of intent, and an assessor will read it as one. We write the other kind, in a half-day with your leadership team, and you make the decisions that go in it.
Certified in the Claude Partner Network Microsoft Solutions Partner ISO 27001 ISO 9001 Independent since 1999
Contents
Eight things a policy has to settle
Each one is a decision your people already make several times a day without a written rule.
- The categories of data that may go in. Client documents, personnel records, unpublished financials, anything under an NDA, code, pricing, draft bids and board papers, each with a yes, a no or a condition. This is the paragraph most often left out, because only you can make the decisions in it.
- The named tools you approve. A register somebody maintains, with every tool named, because a category such as "approved AI tools" is not an answer your team can act on at four in the afternoon.
- Who decides on a new tool and what they check. A named person and a repeatable test. Requests arrive faster than most businesses can assess them, and the gap is where unapproved use starts.
- A direct rule on personal accounts. A personal login on your company email address is the common case. A policy that does not mention it leaves the most likely exposure unwritten.
- Where a person must review the output. AI gets things wrong, so treat that as a design constraint. Name the work where a human checks before anything leaves the building, and the work where output can stand on its own.
- What gets recorded. This is the part an assessor asks about and most policies leave out, so decide what is logged and who can see it before anyone needs to produce it.
- A review date and an owner. Because tools change faster than policies do, a document with neither is out of date within a quarter.
- What it does not cover. Naming the edges is what stops the document being read as covering everything, which is how a policy ends up defending a position it was never written for.
Borrowing one
A template gives you a starting point but controls nothing
You can find a policy template in a few minutes, and there is nothing wrong with starting from one. It gives you the shape of the document, but none of the three things that make the document hold.
It cannot make the decisions. Every useful line in a policy is a choice about your data, your clients and your obligations, and a template leaves those blank or guesses them for a business that is not yours.
It cannot reach your systems. A rule saying people should use approved accounts does nothing until sign-in is brought under your own company account, so that a personal subscription cannot be created on your domain in the first place. That step is configuration, which drafting alone never reaches.
And it cannot produce evidence. When a client, an insurer or an assessor asks how the policy is applied, the answer is a register, a record and a named owner. A document on its own answers none of those questions.
The policy is therefore the visible and smaller part of the work. What we do is settle the decisions with the people who can make them, write the result in language your team can act on and put the configuration behind it so it is true in practice.
So we publish an outline rather than a template: the eight sections and the questions under each, with every answer left blank, because the answers are yours. A filled-in document written for nobody in particular would carry our name onto decisions we did not help you make. Ask us, and you get one written against your data, your clients and your obligations.
Process
A half-day, then a document you can send
It sits inside Govern, the first phase of Track, our AI rollout, and can also be a first piece of work on its own.
- Your leadership team settles the decisions in one half-day workshop. We bring the questions and the categories. The answers are yours, because they are calls about your business that nobody outside it should be making.
- You receive the written policy and an approved tool register. It is written so the people it applies to can follow it.
- Sign-in comes under your company account. That way configuration enforces the rule about personal accounts.
- You can have it kept current. Tools change and the policy has to keep up. Keeping it current is an optional part of Trackside, our monthly service once you are live.
Most businesses want to know what is already in use before they write rules about it. That is the readiness assessment, and it runs first where there is time for it.
Common questions
On policies, bans and who writes what
Do we need one?
Whether anything requires it of you is a legal question for your advisers. What we see is the practical version arriving first: a client sends an assurance questionnaire, an insurer adds a question at renewal or an assessor asks how AI use is controlled. At that point the useful thing is a document you would be content to send, and writing one under that deadline is harder than writing it before.
Could we just ban AI instead?
You can, but a ban does not stop the use, because the tools are free and reachable from a phone. What it removes is your visibility of it, so the use continues and you stop hearing about it. The National Cyber Security Centre reached the same conclusion in its guidance on unapproved AI: understand why people are reaching for these tools and give them an approved route.
Some of our people are already using AI. Is that an issue?
It is the normal starting position and we treat it as one. Nobody broke the rules because nobody had been given any. What matters is finding out what is in use, on whose accounts and what those accounts can reach, then writing rules people can follow from there. Nobody is blamed by name in anything we produce.
Who writes it?
We write the document. You make the decisions in it, in the workshop, because they are calls about your clients and your obligations. A policy written entirely by an outside party is one nobody in the room has agreed to, and it shows the first time somebody tests it.
How often does it need reviewing?
More often than a normal policy, because the tools change underneath it. Set a review date and an owner when you write it. If you would rather not carry that, keeping it current is part of what Trackside does.
Does this make us compliant with anything?
No, and we will not say otherwise. We build the operational controls, the documentation and the evidence trail that your compliance position rests on. Your legal advisers tell you what that position is. The list of what we do not claim is on the Guardrails page.