Glossary Approach & collaboration
AI policy
What is an AI policy?
An AI policy records how an organisation uses AI: which tools are allowed, which data must never go into them, where a person checks and who owns it.
A good AI policy for a mid-sized organisation fits on a few pages and is a working agreement, not a legal document. It covers purpose and scope, approved tools, data rules, human oversight, transparency towards clients, AI literacy and ownership. You can build your own in five minutes with our free AI policy generator.
How do you write an AI policy?
- Take stock of the AI tools your team already uses, official and unofficial.
- Decide what is allowed: which tools are approved and which data never goes into them.
- Set where a person checks the output, and when you tell clients they are dealing with AI.
- Appoint an owner and agree what explanation or training each role gets.
- Review the policy at a fixed moment, for example every six months.
These five steps fit into the broader six-step plan for AI governance, including the AI Act check and AI literacy per role.
The policy also helps with the obligations under the AI Act, such as transparency and supporting AI literacy. Start with the tools already in use: a policy that fits how your team works today gets followed.
What belongs in it is covered in our piece on the AI Act for SMBs.
Last updated: 20 October 2026