AI Governance Policy Starter Template
A fillable PDF template for a first AI governance policy, with guidance notes and a box under each section for your own wording. It begins with who answers for each system.
Free. Type into the boxes on screen, or print it and write by hand.
What the template contains, clause by clause
- Policy details, then purpose and scope written to take in AI features inside software you already buy
- Principles a reader can test against a given use: accountability, human oversight, fitness for purpose, transparency, care with data and proportion
- A roles table for the executive sponsor, system owner, data owner, risk and compliance, security and users
- An inventory table, and an approval clause listing what a proposal for a new use must state
- Clauses for data, oversight, testing and monitoring, change, incidents, suppliers, training, exceptions and review
- Guidance notes that are not part of the policy, and a version history
How to turn it into your policy
- 01
Replace every bracket or leave the clause out
Write your own wording in the box under the clause. A bracket left in an adopted policy tells staff nobody read it. Leave out a section that does not apply instead of softening it.
- 02
Put a person or a role against every duty
A duty given to a committee is easily owned by nobody when something goes wrong.
- 03
Decide which uses take the short route
The approval clause needs a rule for what goes by a light route, such as drafting text a person always reviews, and what needs the full proposal.
- 04
Have it read by someone qualified
Ask a person who can advise on the rules that apply to you to review it before adoption.
Limits
A template is a starting point. It is not legal advice and carries no certification. It must be adapted to your organization and reviewed by someone qualified before adoption.
On this page
Which decisions hide in the brackets?
Each bracket is a decision somebody has to take, and the policy is finished only when each has an answer. The ones below are where a first draft usually stalls, with the role that can usually settle it.
| Clause | What you have to decide | Who can answer it |
|---|---|---|
| Inventory | Which role keeps the list of systems, and what counts as a system when AI is a feature of bought software | Head of IT or the risk lead |
| Approval | Who may approve a new use, and what decides the light route from the full one | Executive sponsor with the risk lead |
| Data | Which tools staff may use with which kinds of data, and what a supplier contract must say about training and deletion | Data protection lead or the general counsel's office |
| Change | Who is told when a supplier changes a model that a live system depends on | System owner |
| Incidents | Who must be told of a serious error and how fast, and who leads the response | Security lead with risk and compliance |
| Exceptions | Who may grant one in writing, and when it ends | Executive sponsor |
What goes beside the policy?
A policy says who decides. The AI Governance Assessment shows where decisions currently have no owner, and the AI Risk Register tracks what is open once the owners exist. Where the policy touches regulation, our AI governance and risk work sits between the template and the lawyer who adopts it.
What do people ask before adopting the policy template?
Can we adopt the AI governance policy template as it stands?
No. It is a starting point, not legal advice, and it carries no certification. It must be adapted to your organization and reviewed before adoption by someone who can advise on the rules that apply to you, since the template cannot know your obligations.
What do I do with the brackets and guidance notes?
Replace every bracket with your own wording in the box under the clause, or leave the clause out, and keep the guidance notes out of the policy you adopt. A bracket left in an adopted policy tells staff nobody read it. If a section does not apply, leave it out instead of softening it.
Who should be named against each duty in an AI policy?
A person or a role, not a committee. A duty given to a committee is easily owned by nobody when something goes wrong. The template includes a roles table covering the executive sponsor, system owner, data owner, risk and compliance, security and users, which is a place to start.
Can I fill in the policy template on screen?
Yes. The tables and the box under each section are form fields in any PDF reader that supports forms, so you can type into them and save the file. You can also print the pages and write by hand. The model wording is fixed, so write your own version beneath it.
Does every use of AI need the full approval route?
Not necessarily. The approval clause needs a rule for what takes a light route, such as drafting text a person always reviews, and what needs the full proposal. The template leaves that choice to you, and your executive sponsor and risk lead can usually settle it.
Writing a policy for a real organization?
Describe what you are weighing in a few lines. A senior practitioner replies with a suggested first conversation.