AI Governance
An AI policy your people will actually follow
Your staff are already using AI, whether or not you have said they can. An AI policy sets out which tools are approved, what data must never go into them, and when a person has to check the output before it is used. We help you write one that fits how your organisation actually works, and that your auditors and customers will accept.
Definition
What is an AI policy?
An AI policy is a short, enforceable document that sets the rules for using AI at work: which tools are approved, what data can and cannot go into them, where human review is required, and who owns the decisions. It is sometimes called an AI acceptable use policy or a generative AI policy.
A good one is read, understood and followed, not filed and forgotten. It is specific to your tools, your data and your sector, and it comes with an approved way to do the things it restricts, so people are not left choosing between the rules and getting their work done.
What it covers
What a good AI policy covers.
Keep it short enough that people actually read it. The useful ones answer a handful of practical questions rather than reciting principles.
- The approved tools, and how to request a new one.
- The data that must never be entered into public AI tools.
- When human review is required before AI output is used or sent.
- How AI features built into software you already run are handled.
- How to report a problem, and who owns and reviews the policy.
Data
What an AI policy should say about data.
The data rules are the part that protects you, so they need to be concrete. Name the categories of information that must never go into a public AI tool, and point to an approved alternative for the work that needs them.
- Personal data, special category data and anything covered by UK GDPR.
- Client-confidential material and anything under an NDA.
- Commercially sensitive information: pricing, contracts, plans, source code.
- Credentials, security details and access information.
Templates
Why a template is not enough.
A downloaded AI policy template names rules nobody follows, because it does not match your tools, your data or your sector. It describes an organisation that is not yours, so people quietly ignore it.
We start from the AI already in use across your business, shape the policy around it, and help you roll it out so it holds. You get a document people act on, not one that sits in a folder. Use a template to see the shape by all means, then fit it to how your organisation actually works.
How we help
How we help.
1.Discovery
Find the AI already in use, including the tools nobody approved and the AI features switched on inside software you already buy.
2.Draft
A policy fitted to your tools, your data and your sector, short enough to be read and specific enough to be followed.
3.Rollout
The comms, the request process and the short training that make it stick, so the policy lands as something useful rather than another document to ignore.
4.Review
A cadence to keep it current as tools and rules change, because an AI policy written once is out of date within months.
Related
Rollout
A policy only works if it is used.
The difference between a policy that works and one that does not is almost never the wording. It is whether people know about it, understand it and have an easy way to do the right thing.
- Clear comms that explain why, not just what, so the rules make sense.
- A simple route to request a new tool, so shadow AI has an alternative.
- Short, specific training for the teams using AI most.
- An owner who can answer questions and approve new uses quickly.
Ownership
Who should own the AI policy.
A named owner, usually in security, risk or IT, with clear support from the board. AI use crosses every department, so ownership needs the authority to set rules and the visibility to keep them current. A policy with no owner drifts out of date and stops being trusted, which is worse than having none at all.
Where it fits
Where an AI policy fits.
An AI policy is one control inside AI governance, and usually the fastest and cheapest to put in place. If you also need to know where AI is used, classify the risk of each use, or prepare for ISO 42001 and the EU AI Act, that is our broader AI governance work, and the policy sits neatly inside it.
FAQ
Questions buyers actually ask
Should a company have an AI policy?
Yes. Staff are almost certainly using AI already, and without a policy there is no record of which tools are allowed or what data is going into them. An AI policy is the cheapest, fastest control you can put in place, and it is the first thing auditors and customers ask to see.What should an AI policy include?
The approved tools and a way to request new ones, the data that must never go into public AI tools, when human review is required, how AI features inside existing software are handled, and who owns the policy and reviews it. Keep it short enough that people actually read it.What should an AI policy say about data privacy?
It should name the categories of data that must never be entered into public AI tools, such as personal data, client-confidential material and anything commercially sensitive, and point to approved tools for work that needs them. It should also say how to report a mistake, so a slip becomes a lesson rather than a hidden breach.Is an AI policy template enough?
A template is a starting point, not a finished policy. It will not match your tools, your data or your obligations, and a policy nobody recognises is a policy nobody follows. Use a template to see the shape, then fit it to your organisation and roll it out properly.Who should own the AI policy?
A named owner, usually in security, risk or IT, with clear support from the board. AI use crosses every department, so ownership needs the authority to set rules and the visibility to keep them current. We help you place it and keep it reviewed.What is the difference between an AI policy and an AI acceptable use policy?
In practice they are the same thing, and the terms are used interchangeably. An acceptable use policy tends to emphasise the rules for staff using AI tools day to day, which is the core of any AI policy. A broader AI policy may also cover how you build or buy AI, and how it is governed.How often should an AI policy be reviewed?
At least every few months to start with, because the tools and the rules are both moving quickly. New AI features appear inside software you already run, new tools get adopted, and the regulatory position shifts. A policy written once and left alone is out of date within a quarter.Does an AI policy help with ISO 42001 or the EU AI Act?
Yes. An acceptable-use policy is one of the controls an AI management system expects, and it is part of the evidence that you govern AI responsibly. It is not sufficient on its own for ISO 42001 or legal compliance with the EU AI Act, but it is a sensible first step towards both.
Write an AI policy your people will follow.
Tell us which AI tools are already in use. We will help you shape a policy that fits your organisation, and roll it out so it holds.
Book a call