AI Insight
AI policy
What should we write down? The decisions an AI policy has to settle, who makes them and what a board, a client or an assessor will ask to see.
Certified in the Claude Partner Network Microsoft Solutions Partner ISO 27001 ISO 9001 Independent since 1999
12 articles
Read these three first
What an AI policy should contain
The eight things an AI policy has to settle before it is worth sending to a client.
Read →An AI policy outline: the eight sections and what goes under each
An outline for an AI policy, free to copy: the details at the top, the eight sections and the questions each one has to answer. Every decision is left blank for you to make.
Read →Why governance comes before adoption
Most businesses buy the AI tool first and write the rules later. What Gartner's forecasts on abandoned AI projects point at, and three things to do this week if the tool is already out.
Read →
For your sector
Five questions a board will ask, the one rule the policy has to open with and where volunteers and personal accounts fit.
What a creative agency's AI policy has to say that other policies do not: client material, who owns AI-assisted work, generator terms, likeness and voice, telling clients, and freelancers.
What a hotel group's AI policy has to say that other policies do not: guest payment and identity data, review replies, shared accounts at the properties, guest-facing AI and who decides between head office and the hotels.
What the SRA's 2026 warning notice, the Ayinde judgment and ABA Formal Opinion 512 ask of a firm using AI, the three things they agree on and what a law firm's AI policy has to say that other policies do not.
What the profession's bodies have said about AI, and the five parts of an accountancy practice's AI policy that carry more weight than in other businesses: client financial data, figures, audit work, engagement terms and the AI arriving inside practice software.
Around the policy
Most AI governance frameworks are written for enterprises. The six parts a business of 50 to 500 people needs, what changes between 50 and 500, how they map to NIST and ISO 42001 and a first 90 days.
An AI policy is the business's position. An acceptable use policy is the page your people follow. What goes in each, whether you need both and the mistakes that push AI use out of sight.
AI governance platforms record AI use, run risk assessments and map controls to frameworks. What they do, who they are built for, what a business of 50 to 500 people can do with tools it already has and the signs it has outgrown them.
Client security questionnaires now ask about AI, usually with a deadline attached. The questions that come up, why a confident no is the riskiest answer, what a strong answer looks like and how to stop writing them from scratch.
Reading for a particular sector? Each sector page applies the route to it.