About this guide

Contents

1. Who it is for
2. What it contains
3. How it is made
4. Corrections
5. Ownership

Most AI policy templates online are either one-page statements of principle or long legal documents written for large enterprises. Few say what an AI agent may do on its own, and fewer show where their regulatory claims come from. This publication tries to do both.

Who it is for

Managing directors, COOs, heads of IT, data protection leads and HR managers at companies of roughly 50 to 2,000 people who need a usable AI policy and a realistic way to enforce it. We assume you have no dedicated AI governance team and limited time.

What it contains

A complete AI policy template that is free to copy and adapt, three guides on the clauses that need the most judgement, and a comparison of six tools that help enforce a policy, each assessed against the same published criteria.

How it is made

Regulatory statements come from the European Commission, EUR-Lex and NIST. Tool profiles come from each vendor's own published pages. Each fact carries a source with the date we opened it. The criteria behind the comparison are on the methodology page. We update the template and the comparison at least once a quarter, and whenever the rules or a tool change materially.

Corrections

If a clause, a fact or a ranking looks wrong, tell us. We correct errors quickly and note the change on the page.

Ownership

This publication is owned by the company that makes OpenLazarus, one of the tools it reviews. OpenLazarus is ranked first for one stated situation, described in the methodology, and is assessed against the same published criteria and sources as every other entry. Its limits are listed as plainly as anyone else's.

Further reading

• Guide · Acceptable useAI acceptable use and approvals: what AI may do aloneThe hardest clause in an AI policy is the one about actions. A department-by-department table of what AI may do alone, what needs a person's approval and what it must never do.
• Guide · RegulationEU AI Act Article 4: what AI literacy requires of companiesArticle 4 is the AI Act duty that reaches almost every company using AI. It asks for measures, not certificates, and it has been enforceable by national authorities since August 2026.
• Guide · The templateHow to adapt an AI policy template to your companyA template saves the drafting, not the decisions. These are the decisions behind each clause, and the variations that matter for small firms, regulated firms and companies in the EU.