Before you start
An AI policy is a short document that tells your team which AI tools they may use, what they may put into them and who is responsible when something goes wrong. It does not need legal language. It needs to be specific, easy to find and owned by a named person.
This guide walks through seven steps, gives a policy outline you can adapt and ends with a checklist. External rules are quoted from the regulator pages listed in Sources. This is general information, not legal advice. Laws and guidance change, so check each point against the current regulator page and with qualified counsel before you act.
It is different from our SME governance checklist, which covers data classification and vendor questions. This guide is about writing the policy document itself.
Step 1. Name an owner and a scope
Pick one person who can approve tools and stop a use case. The NIST AI Risk Management Framework, released on 26 January 2023 for voluntary use, is organised around four functions (Govern, Map, Measure, Manage), and our ethical AI guide makes the same point: name an owner for each AI system, with authority to stop it.
State who the policy covers: employees, contractors and anyone using AI on the company’s behalf.
Step 2. List the AI you actually use
You cannot govern what you have not listed. Make a simple table with the tool, the team using it, the data it receives and where that data is processed. Include features inside tools you already pay for, not only standalone chatbots.
The EU’s Article 50 duties apply, as summarised by Cooley, to AI that interacts with people, that generates synthetic content or that is used for emotion recognition. The list tells you which of those situations your company is in.
Step 3. Set data rules
Decide which data may go into which tool. Use three plain categories and name examples for your business.
| Category | Examples to name | Rule to state |
|---|---|---|
| Public | Published web copy, public price lists | May be used in approved tools |
| Internal | Meeting notes, internal plans | Approved tools only |
| Restricted | Customer personal data, credentials, contracts | Only in tools approved for that category, after the checks in Step 4 |
Our own suggestion, not a legal requirement: make the approved route easy, because staff share data with unapproved tools mostly out of convenience.
Step 4. Check where data goes and who is accountable
Regulators ask the same questions of any outside processor. Canada’s regulator says an organisation is responsible for personal information transferred to a third party for processing and must provide comparable protection through contractual or other means. Australia’s APP 8 requires reasonable steps to ensure an overseas recipient does not breach the APPs. The ICO says a restricted transfer from the UK must be covered by adequacy regulations, appropriate safeguards or an exception.
Put the supplier questions into the policy as a standing approval step: countries of storage and processing, sub-processors, transfer mechanism, access by foreign authorities, breach notice time, deletion at exit. If a tool can act on your systems, add the permission checks in our agent security checklist.
Step 5. Add review and disclosure rules
- Human review: state which outputs must be checked by a person before they reach a customer. The UNESCO Recommendation says AI systems should not displace ultimate human responsibility and accountability.
- Disclosure: say when staff must tell people they are dealing with AI. For EU-facing work, Article 50 transparency duties have applied since 2 August 2026, with a grace period to 2 December 2026 for marking AI-generated content in systems already on the market.
- Accuracy: NIST’s generative AI profile (July 2024) describes confabulation as confidently stated but erroneous or false content, so require checking of facts, figures and quotes.
Step 6. Define incident handling
Say what counts as an incident, who to tell and how fast. Examples: sensitive data pasted into an unapproved tool, an AI output that reached a customer with a material error, or a supplier reporting a breach.
Australia’s Notifiable Data Breaches scheme requires covered organisations to notify affected individuals and the OAIC when a breach involving personal information is likely to result in serious harm. If you operate there, your incident steps must be fast enough to support that.
Step 7. Train, publish and review
Walk the team through the policy with real examples from their work. Publish it where people already look. Record who has read it.
Our own suggestion: review every six months and whenever a tool, supplier or law changes. Note the dates you are watching. For the EU AI Act, the Digital Omnibus on AI, in force since 27 July 2026, moved Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028.
Policy outline you can adapt
Our own suggestion, not a legal requirement. Use these headings and keep each to a few lines.
- 1. Purpose and scope: why the policy exists and who it covers.
- 2. Owner: the named person and how to reach them.
- 3. Approved tools: a table, with the data category each may receive.
- 4. Data rules: public, internal and restricted, with examples.
- 5. Approval of new tools: the supplier questions from Step 4.
- 6. Review and disclosure: what needs human checking and what needs a customer notice.
- 7. Incidents: what to report, to whom and by when.
- 8. Training and review date: when staff are briefed and when the policy is next reviewed.
Checklist before you publish
- An owner is named and has authority to stop a use.
- Every AI tool in use is listed with where its data is processed.
- Restricted data categories are defined with examples.
- Each approved tool has a written answer on storage location, sub-processors and access.
- Customer-facing AI discloses that it is AI where required.
- Outputs that reach customers have a named reviewer.
- The incident route and timing are written down.
- A review date is in the calendar.
- A qualified lawyer has looked at the parts that depend on your market.
Need help assessing a specific tool or building one with these controls? You can schedule a call or read about our custom AI agent work.
Sources
- NIST, AI Risk Management Framework, AI RMF 1.0 released 26 January 2023
- NIST AI 600-1, Generative AI Profile, July 2024
- UNESCO, Recommendation on the Ethics of AI, November 2021
- Cooley, EU AI Act: Transparency Obligations Take Effect 2 August 2026, 3 August 2026
- Lewis Silkin, The Digital Omnibus on AI enters into force today, 27 July 2026
- Office of the Privacy Commissioner of Canada, Guidelines for processing personal data across borders, 27 January 2009
- OAIC, APP 8: cross-border disclosure of personal information
- OAIC, Notifiable Data Breaches
- ICO, International transfers: a guide, updated 15 January 2026
- Zunkiree Labs, Ethical AI: principles, risks and how organizations apply them, 2 October 2026 (our own post, which cites the UNESCO, OECD and NIST pages above)
Frequently asked questions
How long should an AI policy be?
Short enough that people read it. Our own suggestion is one to two pages: approved tools, data rules, review rules, disclosure, incidents and an owner. Put detail in linked procedures rather than in the policy itself.
Does a small team need an AI policy?
No law we cite says every small team must have one, but several rules reward having one. Canada's regulator says an organisation is responsible for data it transfers to a third party for processing, and the EU AI Act sets disclosure duties for some uses. A written policy is how you show you thought about it.
What should the policy say about customer data?
Name the data categories that may never go into unapproved tools, and the approved tools that may receive each category. Regulators ask where data is processed and who can access it, so record those answers for each tool.
How often should the policy be reviewed?
Our own suggestion is every six months and whenever a tool, supplier or law changes. The EU AI Act dates alone moved in 2026, so a fixed policy goes stale quickly.
What you get:
- Seven steps from naming an owner to reviewing the policy
- A data-rules table with three plain categories
- A policy outline with eight headings you can adapt
- A pre-publish checklist of nine items
- Where the EU, UK, Canadian and Australian rules touch a team policy