An AI policy tells staff which AI tools they may use, what data they may enter, who reviews AI output and who owns AI agents. Fill in six fields below and download an editable policy in Word or PDF, with an optional NIST AI RMF mapping. Prefer a ready document? Download the free Word template (.docx).
Build your AI policy
1. Purpose
This policy sets how staff and contractors of [Organization], a small company, may use AI tools for work.
2. Scope
It applies to everyone who uses AI tools on [Organization] work, on any device, including AI agents that act on [Organization]'s behalf.
3. Approved tools
Only these tools are approved: ChatGPT Enterprise, Microsoft Copilot. Any other tool needs written approval from the Head of IT.
4. Data
Data classes are Public, Internal, Confidential and Restricted. Staff may enter only these data types into approved tools: Public and Internal. Restricted data never goes into an AI tool.
5. Rules for AI output
A person reviews AI output before it is used. Check facts, figures and citations. Do not present AI output as professional advice without review. Label AI-generated content where required. Keep the final decision with a named person.
6. Prohibited uses
No decisions about hiring, pay, credit or discipline made by AI alone. No entering credentials, secrets or Restricted data. No use that breaks law, contract or this policy.
7. AI agents
Every AI agent has a named owner, a stated purpose and only the access it needs. The Head of IT approves new agents and their permissions.
8. Reporting and breaches
Report mistakes, data exposure or misuse to the Head of IT the same day. Breaches of this policy may lead to disciplinary action.
9. Review and acknowledgement
The Head of IT reviews this policy every 12 months. Staff confirm in writing that they have read it.
Appendix: NIST AI RMF mapping
Govern: Owner, scope, approved tools, acknowledgement. Map: Approved tools list and the data each tool may receive. Measure: Five rules for AI output: review, accuracy and bias checks. Manage: Prohibited uses, AI agents, reporting and breaches.
Sample clauses
Clause
Sample wording
Approved tools
Only listed tools may be used for work; anything else needs written approval.
Data
Restricted data never goes into an AI tool.
Human review
A person reviews AI output before it is used.
AI agents
Every agent has a named owner and only the access it needs.
Reporting
Report mistakes or data exposure the same day.
NIST AI RMF mapping
NIST function
Where the policy covers it
Govern
Owner, scope, approved tools, acknowledgement
Map
Approved tools list and the data each tool may receive
Measure
Five rules for AI output: review, accuracy and bias checks
Manage
Prohibited uses, AI agents, reporting and breaches
A staff-use policy covers part of the NIST AI RMF. It is a starting point, not legal advice.
How to roll it out in a week
Fill the highlighted organization, owner and review fields.
List the AI tools staff may use and the data each may receive.
Ask legal or HR to review the adapted policy.
Have staff read and sign the acknowledgement.
Review the policy in six months.
Common questions
How do you write an AI policy?
Name an owner, define who and what the policy covers, list approved tools, classify data, set human-review rules, prohibit unsafe uses, and explain how staff report problems. Then have legal or HR adapt it to your organization and jurisdiction.
What should an AI policy include?
It should cover scope, approved tools, data classes, rules for reviewing AI output, prohibited uses, AI agents, applicable laws and frameworks, incident reporting, breaches, and staff acknowledgement.
Does my company need an AI policy?
If staff or contractors use AI for work, a short policy creates a shared rule for tools, data and review. It is especially useful before customer, regulator or insurer questions arrive.
Is this the same as an AI governance policy?
No. This covers staff use; governance also covers inventory, risk assessment and approvals, which the toolkit adds.