This is an outline for an AI policy, and you are welcome to copy it. Under each heading it gives you the questions that section has to answer. Every answer is left blank, because each one is a decision about your data, your clients and your obligations that nobody outside your business should make for you. What an AI policy should contain explains the reasoning behind each section and gives worked examples.
At the top of the document
- The policy's name and version.
- The role that owns it.
- Who approved it and on what date.
- When it will next be reviewed.
- Who it applies to: your own people, contractors, volunteers and anyone else who handles your information.
- Which tools it covers, in a sentence, with a pointer to section 8 for what it does not.
1. The categories of data that may go in
- What are the categories of information your business holds? Typical ones are client documents, personal data, financial figures before publication, material under a non-disclosure agreement, code, pricing and board papers.
- For each category, is the answer yes, no, or yes on a condition?
- What are the conditions, in words a person can check in the moment?
2. The approved tools
- Which AI tools does the business approve? Name each one.
- Is each one used only on the company's own account and never on a personal one?
- For which kinds of work is each one approved?
- Where is the live list kept, so this section can point to it rather than copy it?
3. Who decides on a new tool, and what they check
- Which role decides whether a new tool is approved?
- What is the test? At minimum: where the data goes, what the account can reach, who supplies it and whether there is a reason to use it.
- How does someone ask, and how quickly should they expect an answer?
4. Personal accounts
- What is the rule on using personal AI accounts for work?
- What should someone do if they already have been, and who do they tell?
- What does the business promise in return? For example, that use before the policy will not be treated as misconduct.
5. Where a person must review the output
- Which kinds of work always need a person to read the output before it leaves? Anything with a figure, anything about a named person, anything that becomes a commitment, anything a client will read as a statement of fact.
- Which kinds of work, if any, allow AI output to stand on its own?
- Who reviews, by role, for each kind?
6. What gets recorded
- What is recorded about AI use: the register, approvals, exceptions, incidents?
- Where is it kept, and who can see it?
- How, and to whom, is an AI-related incident reported?
7. Review and ownership
- Who owns the policy day to day?
- How often is it reviewed, and what triggers an earlier review, such as a new tool or an incident?
- Where is the date of the last review shown?
8. What the policy does not cover
- Which AI uses are outside its scope? For example, AI features inside systems still being reviewed, or AI used by suppliers on your behalf, which is covered by supplier management instead.
- What does it not claim to settle, such as legal or regulatory compliance, which stays with your advisers?
Alongside the policy
The page your people follow day to day is shorter: the approved tools, what never goes in, what needs checking and who to ask. AI acceptable use policy sets out how to write it from these eight sections.
The versions for a charity or membership body, a creative agency, a hotel group, a law firm and an accountancy practice show what changes under these headings in each kind of business.
Why there are no answers here
On its own, an outline gives you the shape of the document. A policy that holds needs three things the outline cannot give: decisions your leadership has made, settings in your systems that make the rules true, such as company sign-in, and records that show the policy is followed. That is what the half-day policy workshop produces, and it is the first output of Govern.