How to adapt an AI policy template to your company
A template saves the drafting, not the decisions. These are the decisions behind each clause, and the variations that matter for small firms, regulated firms and companies in the EU.
Contents
An AI policy template does most of the drafting, but none of the deciding. The clauses that matter most, the approved tools, the data rules and the action table, are the ones only the company can fill in. This guide goes through the template on our main page clause by clause.
Why most AI policies fail in practice
Companies rarely fail to write an AI policy. They fail to make it specific. A policy that says "use AI responsibly" gives staff no answer to the questions they face each day: whether a customer contract may go into an assistant, whether the free version of a tool is acceptable, whether an agent may send an email on its own. The evidence suggests the gap is common. In IBM's 2025 breach study, 63% of breached organisations had no AI governance policy or were still developing one, and 97% of those that suffered an AI-related breach had no AI access controls1.
A second failure is writing for yesterday's tools. Policies drafted in 2023 assumed AI meant a chat window. By 2026, AI features sit inside email, documents and business systems, and agents act on records. The European Commission's AI Act timetable has itself changed: the Digital Omnibus, in force since July 2026, moved the application dates for high-risk systems to December 2027 and August 20282.
The clauses that need decisions
| Clause | The decision behind it | Who usually decides |
|---|---|---|
| 4. Roles | Who signs the policy off, and who runs it day to day | Managing director or COO, with the head of IT |
| 5. Approved tools | Which tools, on which accounts, for which work | AI lead with each department head |
| 6. Data rules | Which classes of information never go into AI, and which only into approved tools | Data protection lead and legal |
| 7. Always, ask, never | Which actions each agent may take alone, which need approval, which are forbidden | The team the agent serves and the approving manager |
| 12. New tools | How fast a request is answered, and what a vendor must disclose | AI lead and data protection lead |
| 13. Training | What every employee learns, and what tool owners learn in addition | AI lead, often with HR |
The other clauses (purpose, definitions, disclosure, intellectual property, prohibited uses, incidents, review) can mostly be adopted as written, with the company's own document names substituted for the bracketed references.
Clause by clause
Scope (clause 2). Include contractors and AI used by suppliers on your behalf. The European Commission notes that Article 4 extends to "persons broadly under the organisational remit", such as contractors and service providers3, so a scope limited to employees leaves a gap.
Approved tools (clause 5). The register works only if approved tools are at least as convenient as personal ones. Microsoft's 2024 survey found 78% of AI users bringing their own tools to work4; a register that bans everything simply moves use out of sight. Record the account type, because the data terms of a company account often differ from those of a free one.
Data rules (clause 6). Write the "never" list in the company's own terms: name the product source code, the pricing model, the unreleased results. Generic categories are easy to agree with and hard to apply. Check each approved tool's terms on training: Google, for example, states that Gemini in Workspace does not use customer content to train models outside the customer's domain without permission5.
Always, ask, never (clause 7). This is the clause most older templates lack. The defaults in the template are deliberately conservative: anything external, financial or affecting a person's record sits in "Ask" or "Never". Clause 7.3 requires these categories to be enforced by the system rather than by an instruction to the AI, because an instruction can be ignored or overridden. Our guide to acceptable use and approvals works through the table department by department.
Prohibited uses (clause 11). Article 5 of the AI Act prohibits a short list of practices outright, including manipulative techniques that cause harm, social scoring and inferring emotions in the workplace or in education6. Citing it keeps the clause anchored to the law rather than to taste.
Training (clause 13). The Commission states that no certificate or mandatory training format is imposed for AI literacy, and that organisations can keep an internal record of what they did3. A short, recorded session per role is proportionate for most companies. The Article 4 guide covers what to include.
Records (clause 15). Require agents to run in systems that log actions and approvals. Microsoft Purview records AI interactions, including prompts and responses for users with the right permissions7; OpenLazarus states on its industry pages that every action its AI teammates take is logged where compliance can see it8.
Variations by company type
- Under 50 people. Merge the executive owner and AI lead. Replace clause 12 with "the owner approves every new tool in writing". Keep clauses 6 and 7 in full: small companies are no less exposed when a contract or a payment goes wrong.
- Regulated firms (finance, health, legal). Add the sector regulator's guidance to clause 6, require a second approver for "Ask" actions involving client money or advice, and shorten the review cycle in clause 16 to three months.
- Companies in the EU. Reference Article 4 in clause 13, Article 5 in clause 11 and your data protection officer in clause 4. Where a works council exists, involve it before clause 11.2 on monitoring is adopted.
- Companies building their own models. The template covers use, not development. Add a model-lifecycle annex aligned to a framework such as the NIST AI RMF, which organises the work under govern, map, measure and manage9.
A path from template to adopted policy
- Draft in a week. Fill in clauses 4, 5 and 6 from an inventory of tools already in use.
- Workshop clause 7. One hour per team that uses an agent, with the approving manager present.
- Legal and data protection review. Check the draft against employment contracts, existing IT and privacy policies and any works council agreements.
- Approve and publish. The executive owner signs; the policy goes to all staff with the acknowledgement in clause 17.
- Configure, then train. Controls first, so that the training shows the real settings.
- Review at 90 days. Use incident reports and activity logs to adjust the appendices.
A company that has done this can answer three questions on demand: which AI tools are in use and who owns them, what each AI agent is allowed to do, and who has been trained. Those are the questions an auditor, a regulator or a customer's security review is most likely to ask.
Questions buyers ask
Can we use an AI policy template as it is?
Only after filling in the fields that describe your company: the owners, the approved tools, your data classes and the action table for each AI agent. Those are the clauses that make a policy enforceable, and no template can write them for you.
Should a small company have a shorter AI policy?
A company of fewer than 50 people can merge roles, so one person may own the policy and run the tool register, and it can drop the vendor-approval workflow in favour of a simple rule that the owner approves every new tool. The data rules and the action table should stay.
Should the AI policy be separate from the IT or data protection policy?
Usually yes, with cross-references. AI raises questions those policies do not answer, such as which actions an agent may take on its own and how AI output is reviewed, and a separate document is easier to update as the tools change.
Sources
- IBM Report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls. IBM Newsroom, 30 Jul 2025. Accessed 8 Nov 2026.
- AI Act: regulatory framework for AI. European Commission, 19 Oct 2026. Accessed 8 Nov 2026.
- AI Literacy: Questions & Answers. European Commission, 20 Oct 2026. Accessed 8 Nov 2026.
- AI at work is here. Now comes the hard part (2024 Work Trend Index). Microsoft WorkLab, 8 May 2024. Accessed 8 Nov 2026.
- Generative AI in Google Workspace Privacy Hub. Google Workspace. Accessed 8 Nov 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act). EUR-Lex, Official Journal of the European Union, 12 Jul 2024. Accessed 8 Nov 2026.
- Learn about Data Security Posture Management for AI (classic). Microsoft Learn, 15 Dec 2025. Accessed 8 Nov 2026.
- OpenLazarus for financial services. OpenLazarus. Accessed 8 Nov 2026.
- AI Risk Management Framework. National Institute of Standards and Technology. Accessed 8 Nov 2026.
Updated 8 Nov 2026: First published.