AI Policy Template for business

AI policy – adaptable draft

AI POLICY FOR [ORGANISATION]
Version: [VERSION] · Draft dated [DATE]
Owner: [ROLE AND NAME] · Approval: [ROLE AND DATE]
Next review: [DATE]

Working draft: complete the placeholders, adapt the rules to actual operations and obtain review from the responsible functions. This draft does not constitute legal approval.

1. Purpose and scope
This policy governs professional AI use at [ORGANISATION] for [TEAMS, LOCATIONS AND GROUPS OF PEOPLE]. Its aims are traceable results, protected information and clear accountability. It covers [BUSINESS PROCESSES] and AI use by [EXTERNAL SERVICE PROVIDERS]. The named person remains accountable for the work.

2. Permitted uses and boundaries
Approved uses are recorded in [REGISTER WITH ACCOUNTABLE OWNERS]. Each use case specifies its purpose, inputs, intended output, permitted actions and acceptance criteria. Unapproved or excluded uses are [USES AND ACTIONS]. New use cases must be reviewed by [RESPONSIBLE FUNCTION] before use. AI must not substitute for a missing approval.

3. Data classes and inputs
Public information may be used in approved systems; sources and usage rights must be checked. Internal information may be processed only through approved business accounts. Confidential information requires documented approval of the specific data flow. Particularly sensitive information remains blocked until the responsible functions provide written approval with safeguards. The applicable framework is [INTERNAL CLASSIFICATION SCHEME AND REGISTER]. Enter only necessary data; credentials, private keys and unnecessary personal information are excluded.

4. Approved systems and accounts
The system register [LOCATION] records provider, product, plan, account ownership, responsible administrator and permitted data classes. It also records [RETENTION, TRAINING SETTINGS AND PROCESSING LOCATIONS]. Professional use takes place through [APPROVED ACCOUNTS AND SIGN-IN METHODS]. Personal accounts, trials and new products require the defined approval process.

5. Permissions and integrations
Access is limited to the rights necessary for the approved workflow. Connectors, data sources and external tools require approval by [ROLE]. Documentation covers readable data, possible write actions, approval steps and shutdown procedures. Setup, periodic access review and removal after a role change or departure are handled by [OWNERS AND PROCEDURE]. A written instruction does not replace a technical access restriction.

6. Human review and approval
Outputs are reviewed by [ACCOUNTABLE DOMAIN ROLE] against the agreed criteria. Explicit approval is required before [EXTERNAL COMMUNICATION, CONTRACT-RELATED CHANGES OR OTHER APPROVAL-GATED ACTIONS]. If sources conflict, information is missing or responsibility is unclear, the workflow stops and refers the matter to [CONTACT]. Approvals must be traceable through the output, approving person and time recorded in [LOCATION].

7. Quality checks and evidence
Before use, typical cases, exceptions and failures are tested against [TEST AND ACCEPTANCE PLAN]. Facts and sources must be checked; unsupported statements must not be adopted as established facts. Record [REQUIRED EVIDENCE, SYSTEM VERSION AND REVIEW OUTCOME]. Logs contain only necessary information and follow [RETENTION AND ACCESS RULES]. Changes to models, instructions or integrations trigger the defined repeat checks.

8. Disruptions and incidents
If a possible data leak, incorrect external action or other relevant failure occurs, suspend the affected processing where it is safe to do so. Report promptly through [REPORTING CHANNEL] to [RESPONSIBLE ROLE]. Record the time, affected workflow and necessary details without spreading additional confidential information through uncontrolled channels. [RESPONSIBLE FUNCTIONS] decide on investigation, further reporting and resumption.

9. Training and support
Before use, staff receive training on [SYSTEMS, DATA CLASSES, BOUNDARIES AND APPROVALS]. Exercises include source checks, uncertain outputs and incident handling. Questions and support needs go to [CONTACT]. [ROLE] owns training, records and appropriate refreshers. New workflows are adopted only after the relevant training.

10. Ownership, exceptions and review
[ROLE] owns this policy. The document header records approval, version and next review. Additional reviews take place when systems, integrations, data classes, incidents or operational requirements change. Exceptions require a documented purpose, accountable person, safeguards and expiry date, approved by [ROLE]. Current and superseded versions are maintained in [LOCATION].

Adapt before adoption

Replace every square-bracket placeholder
Name approved systems together with plan and enabled integrations
Align data classes with existing information-security rules
Involve employee representatives, privacy, security and legal counsel according to actual responsibilities

Connect policy and technology

A policy works only when identity, roles, connectors, retention, logging and approvals enforce the same boundaries. Exceptions need a documented approval and expiry path.

Review and version control

Record the accountable owner, approval date and next review in the document. Review additionally when systems, integrations, data classes, incidents or material legal requirements change.

Decision matrix

Data class	Template rule	Additional check
Public	permitted in an approved system	rights and facts
Internal	approved business account only	plan, connectors and retention
Confidential	documented use-case approval only	data minimisation and permissions
Special-category	blocked until written approval	law, privacy and safeguards

Keep it verifiable

Primary sources

EU AI ActSource checked: 2026-08-13
EDPB: data protection and AISource checked: 2026-08-13

Turn AI use into a clear operating rule.

AI policy – adaptable draft

A good fit when

Not the first choice when

Adapt before adoption

Connect policy and technology

Review and version control

Decision matrix

Primary sources

Which AI system fits your business?

AI policy – adaptable draft

A good fit when

Not the first choice when

Adapt before adoption

Connect policy and technology

Review and version control

Decision matrix

Primary sources

Which AI system fits your business?

The next good question.

AI policy for business

Editorial policy and sources that make accountability visible.

An AI setup your team can start using.