Guide
AI policy template: what a company AI policy should include
Most companies already use AI — in writing tools, support desks, recruitment software or code assistants — long before anyone writes down the rules. An AI policy sets those rules in one place so staff know what is allowed, and so you can answer customers who ask how you govern AI.
1. Purpose and scope
State why the policy exists and who it covers: employees, contractors and anyone using AI on the company's behalf. Define what counts as an AI system for your purposes — including AI features built into tools you already pay for.
2. Approved and prohibited uses
List the AI tools that are approved, the uses that need prior approval, and uses that are not allowed at all.
- Approved: named tools for drafting, summarising or coding, under the data rules below.
- Needs approval: anything that makes or supports decisions about people (hiring, performance, credit), or that customers interact with directly.
- Not allowed: entering confidential or personal data into unapproved tools, or presenting AI output as reviewed when it is not.
3. Data rules
Say which categories of data may be used with which tools. Link the rules to your existing data protection practice rather than writing a second rulebook.
4. Human review and accountability
Make clear that a named person remains responsible for any output that is shared, published or used in a decision, and describe when a second review is required.
5. Roles and ownership
Name an owner for the policy and for the AI inventory, and say who approves new tools and use cases.
6. Vendors and new tools
Describe the checks a new AI vendor must pass before use: where data is processed, whether it is used for training, contractual terms and security information.
7. Training and AI literacy
Record who has been trained, on what, and when. This also supports the AI literacy expectations in the EU AI Act.
8. Incidents and review cycle
Explain how staff report problems with AI output or misuse, and set a date to review the policy — at least yearly, and whenever a significant new tool or use case is added.
Keep the policy tied to reality
A policy is only credible if it matches the tools and use cases you actually have. TrustPack AI builds the policy from your recorded AI inventory, vendors and assessment answers, so every statement can be traced back to a fact about your organisation.
This guide is general governance information, not legal advice. Specialist review is recommended before relying on it for regulatory decisions.