AI policy template: how to write one your people will follow
← INSIGHTS

AI policy template: how to write one your people will follow

Use is close to universal and formal policy is not. Here is a ten-section AI policy template, sample wording, and a two-week process to write one.

BY STEFAN MARITZ··8 MIN READ

TL;DR

  • ISACA's 2026 AI Pulse Poll found that 90% of digital trust professionals believe employees use AI at work, yet only 38% of organisations have a formal, comprehensive AI policy.
  • A policy people follow is short, says what to do as well as what to avoid, names the approved tools, and has an owner.
  • This guide gives a ten-section template, sample wording for the data rules, and a two-week process for writing it.
  • Start from what people already use. A policy written without that knowledge tends to describe an organisation that does not exist.
  • Gallup associates responsible-use guidelines with higher AI use or stronger views of its benefits, so a good policy supports adoption.
  • Have legal counsel review the final draft, especially for POPIA or GDPR obligations.

I think most AI policies fail in one of two ways. They run so long that nobody reads them, or they are so restrictive that people quietly work around them. A useful policy sits between the two: short enough to remember, specific enough to act on, and clear about what people are allowed to do.

This guide offers a ten-section template for a mid-sized organisation, sample wording, and a process for writing it in about two weeks. It is not legal advice, so ask your own counsel to review the result.

Why have a policy now

ISACA's 2026 AI Pulse Poll, released in May with more than 3,400 digital trust professionals, found that 90% believe employees use AI in their organisation. Only 38% report a formal, comprehensive AI policy, up from 28% in 2025. Another 30% have a limited policy, and 25% have none.

Use is close to universal and policy is not. A policy is also one of the cheapest controls available, because it costs time rather than licences.

It supports adoption too. Gallup's research lists a clear strategy, role-specific training, and responsible-use guidelines among the factors associated with higher AI use or stronger evaluations of its benefits. A policy is often framed as a brake. Gallup's data suggests clear guidance goes with more use, not less.

What makes a policy people follow

Four properties matter most.

  • It is short. Two to four pages is a sensible target for a mid-sized organisation. Nobody has proved a right length, but a document people finish is better than a thorough one they skim.
  • It says what to do. Salesforce's guidance on internal AI policies makes the point that the most effective ones do more than list prohibitions. They show what people should do, including approved use cases, tools, and workflows.
  • It names tools and people. Approved tools, who decides on new ones, and who to ask when something is unclear.
  • It has a review date. AI tools change quickly, and Salesforce also recommends setting a cadence for updates.

A community article on the European Commission's Futurium platform adds a warning about implementation. A policy only changes behaviour once managers and employees turn it into procedures they follow day to day.

The template: ten sections

The Futurium article suggests a fuller structure covering scope, definitions, organisational context, governing roles, ethical principles, permitted and prohibited systems, obligations and incident processes, links to other policies, and general provisions. For a mid-sized business, I would compress that into ten sections.

  1. Purpose and scope. Who the policy covers, including contractors, and what counts as an AI tool. Two or three sentences.
  2. Definitions. One sentence each for "AI tool" and "confidential data".
  3. Approved tools. List them by name, say what each is approved for, and explain how to request a new one.
  4. Data rules. What never goes into any tool, what needs care, and what is fine.
  5. Human review. A person checks and owns every output that leaves the organisation or informs a decision.
  6. Disclosure. When to tell clients or colleagues that AI was used.
  7. Roles. An owner for the policy, an approver for new tools, and a named person to ask.
  8. Incidents. What to do if something goes wrong, with a reporting route that does not punish honest mistakes.
  9. Consequences. Proportionate, and explained so people can see the logic.
  10. Review. A date, an owner, and a way for staff to suggest changes.

Sample wording for the data rules

This is the section people read most, so write it in plain language. Adapt the lists to your own legal and client obligations.

Never put these into any AI tool, approved or not: client personal information, passwords and access keys, documents under confidentiality terms, and unreleased financial results.

Use care with internal documents that are not public. Use approved tools only, and remove names and figures where you can.

Public information, your own draft text with no client details, and general questions are fine in any approved tool.

You are responsible for anything you send, whether or not AI helped write it.

Writing it in two weeks

Week one. Find out what people already use, through a short anonymous survey and conversations with team leads. Our guide to shadow AI covers how to do this without making people defensive. List the main use cases in each function, speak to legal, IT, HR, and operations, and decide which tools you will approve.

Week two. Draft the policy and test it with one team. Ask them to apply it to five real tasks and note where the wording was unclear. Revise, send it for legal review, and publish it with a short briefing. The test of a policy is whether someone in a hurry can apply it, and only a real trial shows that.

Making it stick

A policy alone does not change behaviour. Managers who use the tools and talk about them do more, which we cover in our guide to AI adoption. Where possible, build the rules into the tools themselves. Salesforce notes that tools with built-in guardrails help people follow safe practices without extra friction.

Common mistakes

  • Copying a template unchanged. Free templates are a useful start, and they describe someone else's organisation.
  • Banning everything. Blanket bans tend to push use out of sight.
  • Publishing a policy with no approved tool. People will find their own.
  • Leaving out an owner or a review date. Without them, the policy ages quietly.
  • Writing for lawyers. If staff need a legal dictionary to read it, they will not.

A policy is one part of AI governance, alongside strategy, data, people, and tooling. If you want to see where your organisation stands on all of them, the AI Readiness Diagnostic is free to take.

Frequently asked questions

What should an AI policy include?

At a minimum: purpose and scope, approved tools, data rules, human review, roles, an incident route, and a review date. The ten-section template above covers these and a few more.

How long should an AI policy be?

There is no standard length. For a mid-sized organisation, two to four pages is a practical target, because people are more likely to read and remember it.

Who should write the AI policy?

A small group drawn from legal, IT or security, HR, and the business functions that use AI most, with one named owner. Salesforce recommends involving legal, security, HR, procurement, and engineering in the drafting.

How often should an AI policy be reviewed?

No standard exists. I suggest reviewing it at least twice a year at first, because tools and regulation are changing quickly. Pick a date and keep it.

Do small organisations need an AI policy?

Yes, in a lighter form. A one-page version covering approved tools, data rules, and who to ask is enough to start.

WORK WITH PRAXES

Ready to move from reading about AI to getting your organisation ready for it? Start with the diagnostic.

Take the AI Readiness Diagnostic