Your staff already use AI. Does your policy say how?
Employees are already pasting text into chat assistants, often through personal accounts. Without clear rules, confidential data ends up in prompts, AI-generated code ships without review and nobody knows which tools are in use.
This template gives you a structured, defensible starting point you can adapt and approve in days, not months.
Aligned with the frameworks that matter
A policy that covers the full AI lifecycle
- 1
Purpose and scope
Employees, contractors and vendors; in-house models, AI agents (MCP), SaaS tools and AI features built into your software.
- 2
Governance and risk
Legal compliance, trustworthy-AI principles, an AI inventory, approved and prohibited tools, safe decommissioning.
- 3
Roles and RACI matrix
Clear accountability from executives to every employee, with a ready-to-edit RACI table.
- 4
Human oversight
When a human must approve (in the loop) or supervise (on the loop), and defences against hallucinated output.
- 5
Privacy and data protection
Consent, data minimization, deletion and vector isolation, protection of sensitive groups.
- 6
Access control and acceptable use
Monitoring, and what staff must never enter into an AI tool, from passwords to client data.
- 7
Local vs. external AI
Security baselines for self-hosted models and for commercial AI services and APIs.
- 8
Risk and OWASP threat model
The 10 LLM risks mapped to mandatory controls, a mitigation checklist and an exception process.
- 9
Culture and incident response
A no-blame reporting culture and an AI incident playbook: containment, taint assessment, breach notification.
- 10
Training, vendors and enforcement
Annual training, vendor terms (zero data retention, 60-day change notice, exit plans), audit rights and sanctions.
Plus: approval and sign-off table, revision history, a detailed OWASP appendix with examples, and a glossary.
One short form, asked only once. The first time you download something, we ask for a few details. After that, every download on this site (campaign kit, AI policy template, video series) opens directly for 30 days. Watching the videos online never requires the form.
From template to approved policy in five steps
- Fill in the basics: organization name, policy owner, approvers and dates. The names in the sample sign-off table are placeholders.
- Build your approved AI tool list. Section 2.5 depends on it: list the tools you license with zero-data-retention terms.
- Adjust the RACI matrix to your organization chart. Each activity needs exactly one “A”.
- Review with legal and privacy, then approve and announce it. Our Shadow AI video is a great way to explain the “why” to staff.
- Review it every year, or whenever a major regulation or incident calls for it.