Guide
How to write an AI policy and set up AI governance
A practical step-by-step plan for AI policy and governance: what it covers, who owns it and how you keep it alive.
What an AI policy is for
An AI policy sets out which AI tools are allowed, which data may go in and who to ask when in doubt. It helps you classify data and set responsible-use guardrails you can defend to IT and security.
Keep it short and practical, and give it an owner in the business, with support from legal, IT and privacy.
Writing an AI policy in five steps
Start small and practical.
Take stock of current use
Which AI tools are people using already, for which tasks and with which data? Ask, don't assume.
Choose and check your tools
Pick the tools you allow and check per tool where data is stored, whether there is a DPA, and whether your data is used for training. Our data security guides per tool help with this.
Write the rules of use
Classify data (public, internal, confidential, personal data) and state per class what may go into which tool. Add rules for checking AI output.
Assign ownership
Name an owner in the business, a contact point for questions and a moment for periodic review.
Train and keep it alive
Explain the policy in a short session, link it to practical training and collect questions. A policy only works when people know it and use it.
What goes in it
The contents of a practical AI policy
Use this as a checklist. Keep it short enough that people actually read it.
- Purpose and scope: who and which tools it applies to
- List of approved AI tools and how to request a new one
- Data classes and what may be shared with which tool
- Rules for reviewing and using AI output
- Transparency towards customers and colleagues
- Owner, contact point and review moment
- Link to training and AI literacy
Questions about AI policy
What is an AI policy?
A set of agreements on how your organisation uses AI: which tools are allowed, which data may be shared, how output is checked and who is responsible.
Is an AI policy mandatory?
An AI policy is a practical way to agree which tools and data are allowed. Whether and how rules such as the GDPR and the EU AI Act apply depends on your tools and how you use them; check with your legal adviser. This guide is a practical overview, not legal advice.
Who should own the AI policy?
Preferably someone in the business, with support from legal, IT and privacy.
How often should we update it?
Regularly, and whenever you introduce a new tool.
Set up AI governance with your leadership team
We help you define policies for AI usage and data handling as part of an AI strategy, including a governance framework and an AI policy draft.