AI Governance Policy Starter Template
Staff are already using AI, and nobody has written down who decides what. This AI governance policy template gives you the sections a first policy needs, with guidance notes and a box under each for your own wording. It starts with who answers for each system.
Free. Type straight into the boxes, or print it and use a pen.
What the AI governance policy template contains, clause by clause
- Policy details, then a purpose and scope written to cover AI features inside software you already buy
- Principles you can test a particular use against: accountability, human oversight, fitness for purpose, transparency, care with data and proportion
- A roles table for the executive sponsor, system owner, data owner, risk and compliance, security and users
- An inventory table, and an approval clause listing what a proposal for a new use has to state
- Clauses on data, oversight, testing and monitoring, change, incidents, suppliers, training, exceptions and review
- Guidance notes that stay out of the policy itself, and a version history
How to turn it into your policy
- 01
Replace every bracket or drop the clause
Put your own wording in the box under the clause. A bracket left in an adopted policy tells staff nobody read it. If a section doesn't apply, leave it out rather than soften it.
- 02
Put a person or a role against every duty
A duty handed to a committee is easily owned by nobody when something goes wrong.
- 03
Decide which uses take the short route
The approval clause needs a rule for what goes through a light route, such as drafting text a person always reviews, and what needs a full proposal.
- 04
Have someone qualified read it
Before you adopt it, ask a person who can advise on the rules that apply to you to review it.
Limits
A template is a starting point. It isn't legal advice and carries no certification. You need to adapt it to your organization, and someone qualified should review it before you adopt it.
On this page
Which decisions hide in the brackets?
Every bracket is a decision somebody has to take, and the policy is finished only when each one has an answer. The clauses below are where a first draft usually stalls, with the role that can usually settle each.
| Clause | What you have to decide | Who can answer it |
|---|---|---|
| Inventory | Which role keeps the list of systems, and whether AI features in bought software count as systems | Head of IT or the risk lead |
| Approval | Who may approve a new use, and what separates the light route from the full one | Executive sponsor with the risk lead |
| Data | Which tools staff may use with which kinds of data, and what a supplier contract must say about training and deletion | Data protection lead or the general counsel's office |
| Change | Who hears when a supplier changes a model that a live system depends on | System owner |
| Incidents | Who must be told about a serious error, how fast, and who leads the response | Security lead with risk and compliance |
| Exceptions | Who may grant one in writing, and when it ends | Executive sponsor |
What goes beside an AI governance policy?
The policy says who decides. The AI Governance Assessment shows where decisions have no owner today, and the AI Risk Register tracks what is open once the owners exist. Where the policy touches regulation, our AI governance and risk work sits between the template and the lawyer who adopts it.
What do people ask before adopting the AI governance policy template?
Can we adopt the AI governance policy template as it stands?
No. It is a starting point, not legal advice, and it carries no certification. Adapt it to your organization and have someone who can advise on the rules that apply to you review it before adoption, because the template cannot know your obligations.
What do I do with the brackets and guidance notes?
Replace each bracket with your own wording in the box under the clause, or drop the clause, and keep the guidance notes out of the policy you adopt. A leftover bracket tells staff nobody read it. If a section doesn't apply, leave it out instead of softening it.
Who should be named against each duty in an AI policy?
A person or a role, never a committee, since a duty given to a committee is easily owned by nobody when something goes wrong. The template includes a roles table for the executive sponsor, system owner, data owner, risk and compliance, security and users, which is a place to start.
Can I fill in the policy template on screen?
Yes. Open the PDF in a viewer that handles forms, click into the tables and the box under each section, type, and save your copy. Paper works too if you would rather print it. The model wording is fixed, so write your own version beneath it.
Does every use of AI need the full approval route?
Not necessarily. The approval clause needs a rule for what takes a light route, such as drafting text a person always reviews, and what needs a full proposal. The template leaves that choice to you, and your executive sponsor and risk lead can usually settle it.
Writing a policy for a real organization?
Tell us what your staff are already doing with AI and who has been asked to write the policy. Someone senior reads it and says where we would start.