AI Policy Template: Governance Policy and Acceptable Use Policy

An AI policy template should give you two documents: an AI governance policy that states the company's principles, scope, accountability, and risk approach, and an AI acceptable use policy that tells employees which AI tools they can use and how. Below are both, with section-by-section sample language you can adapt, followed by how to align them with ISO/IEC 42001 Annex A.2.

The sample language is original and written for a B2B software company of 20 to 500 people. Replace bracketed text, delete what does not apply, and have counsel review before adoption. It is a starting point, not legal advice.

How the two policies fit together

	AI governance policy	AI acceptable use policy
Audience	Leadership, product, engineering, risk, auditors, customers	All employees and contractors
Purpose	Commitments and accountability for all AI the company builds, provides, or uses	Practical rules for using AI tools at work
Approver	CEO or executive team	AI governance lead or committee, under the governance policy
Length	2–4 pages	2–3 pages
ISO 42001 link	Clause 5.2, Annex A.2.2	Supports A.9 (use of AI systems), clause 7.3 (awareness)

Keep both short. Put procedures (how to run a risk assessment, how to request a tool) in separate documents the policies reference. That way you can update procedures without re-approving the policy.

Template 1: AI governance policy

1. Purpose

This policy sets out how [Company] develops, provides, and uses artificial intelligence responsibly. It establishes the principles we follow, who is accountable, and how we identify and manage risks and impacts from AI systems, so that our use of AI supports our business objectives and earns the trust of customers, employees, and the public.

2. Scope

This policy applies to all AI systems that [Company] develops, integrates into its products or services, procures from third parties, or uses internally, and to all employees, contractors, and third parties acting on our behalf. "AI system" means a machine-based system that generates outputs such as predictions, content, recommendations, or decisions from the inputs it receives. [List any exclusions and the reason for each.]

3. Principles

When we build, buy, or use AI, we commit to:

• Accountability. Every AI system has a named owner responsible for its risks and performance.
• Human oversight. People can understand, monitor, and override AI outputs where the consequences warrant it.
• Fairness. We assess and reduce unwanted bias that could disadvantage individuals or groups.
• Transparency. We tell users when they are interacting with AI or receiving AI-generated content, and we document how our systems are intended to be used.
• Privacy and security. We protect personal and confidential data across the AI life cycle, consistent with our information security and privacy policies.
• Reliability. We test AI systems against defined requirements before release and monitor them in operation.
• Lawfulness. We meet applicable legal, regulatory, and contractual obligations.

4. Roles and responsibilities

• Executive sponsor ([title]) approves this policy and provides resources.
• AI governance committee oversees AI risk, approves high-risk use cases, and reviews this policy.
• AI governance lead ([title]) maintains the AI management system, the AI inventory, and supporting procedures.
• System owners ensure their AI systems are assessed, documented, monitored, and operated as intended.
• All personnel follow this policy and the AI acceptable use policy and report concerns.

5. AI inventory

The AI governance lead maintains an inventory of all in-scope AI systems, including owner, purpose, data used, affected parties, supplier, and risk tier. No AI system may be deployed to production or used with confidential data unless it is recorded in the inventory.

6. Risk and impact assessment

Each AI system is assessed for risks to [Company] and for potential impacts on individuals, groups, and society before deployment, after significant changes, and at least [annually]. Assessments follow the AI risk assessment procedure and the AI impact assessment procedure. Residual risks above [threshold] require approval by the AI governance committee.

7. Life-cycle requirements

AI systems we develop follow our development life cycle, including documented requirements, data quality and provenance checks, verification and validation before release, approved deployment, monitoring in operation, and controlled retirement.

8. Third parties

AI suppliers are assessed before onboarding and periodically after. Contracts address data use, including whether our data may be used for model training, security, incident notification, and allocation of responsibilities. Where we provide AI to customers, we document intended use, limitations, and responsibilities.

9. Reporting concerns and incidents

Anyone may report a concern about an AI system to [channel], including anonymously through [channel]. We do not retaliate against good-faith reports. AI incidents are handled under the incident response procedure, including notification of affected customers or authorities where required.

10. Objectives and continual improvement

The AI governance committee sets measurable AI objectives each year and reviews progress. Nonconformities are corrected and their causes addressed.

11. Relationship to other policies

This policy works alongside the information security policy, privacy policy, data governance policy, code of conduct, and [others]. Where policies conflict, the stricter requirement applies until the conflict is resolved by the policy owners.

12. Review and approval

This policy is reviewed at least annually and after significant changes to our AI use, business, or legal obligations. Approved by [name, title] on [date]. Version [x.x].

Template 2: AI acceptable use policy (employees)

1. Purpose and scope

This policy explains how [Company] employees and contractors may use AI tools, including generative AI chat assistants, coding assistants, and AI features within approved business software, when doing work for [Company].

2. Approved tools

Use only AI tools listed on the approved AI tools list at [link]. Approved tools have been reviewed for security, privacy, and contractual data protections. To request a new tool, submit [form]; we aim to respond within [X] business days. AI features inside already-approved software are covered only if listed.

3. Data you may and may not enter

Data classification	Approved enterprise AI tools	Unapproved or personal AI tools
Public	Allowed	Allowed
Internal	Allowed	Not allowed
Confidential (customer data, source code, financials, roadmaps)	Allowed only where the tool list says so	Not allowed
Restricted (credentials, secrets, special-category personal data, regulated data)	Not allowed unless specifically approved	Not allowed

Never enter passwords, API keys, or access tokens into any AI tool.

4. Reviewing outputs

You are responsible for anything you produce with AI assistance. Check outputs for accuracy, confidentiality, bias, and third-party rights before using them. AI-generated code follows the same review, testing, and security scanning as any other code.

5. Prohibited uses

Do not use AI tools to:

• make or materially inform decisions about hiring, firing, performance, pay, or credit for any individual without approval from [HR or legal] and the AI governance committee;
• impersonate a real person or create deceptive content;
• process customer data outside the purposes our contracts allow;
• get around security controls or company policies.

6. Disclosure

Tell customers or recipients when content they receive was substantially generated by AI where our contracts, the law, or common sense require it. Do not present AI output as independent human analysis when it is not.

7. Building with AI

If you plan to add AI to a product, an internal workflow that affects customers, or an automated decision, register it with the AI governance lead first. It must go through risk and impact assessment under the AI governance policy.

8. Reporting

Report suspected misuse, data exposure, or harmful outputs to [channel] right away. Accidental disclosure reported promptly is treated as a learning opportunity.

9. Consequences and acknowledgment

Breaches of this policy may lead to disciplinary action. I confirm I have read and will follow this policy. [Signature / electronic acknowledgment, date]

Adapting the templates to ISO 42001 Annex A.2

Annex A.2 of ISO 42001 covers policies related to AI and has three controls. Here is how the templates map, in plain language rather than standard text.

Annex A.2 control	What an auditor will look for	Where it lives in the templates
A.2.2 AI policy	A documented AI policy approved by top management, communicated, and fit for your context	Governance policy, sections 1–10 and approval block
A.2.3 Alignment with other organizational policies	Evidence you checked how AI affects existing policies (security, privacy, data, HR) and updated them where needed	Governance policy section 11, plus change records in those other policies
A.2.4 Review of the AI policy	Planned reviews at defined intervals, with records, and reviews triggered by change	Governance policy section 12 and a review log

Clause 5.2 of the standard adds requirements for the policy itself. In plain terms, the policy should be appropriate to your organization, give a framework for setting AI objectives, and include commitments to meet applicable requirements and to continually improve the AI management system. The template covers these in sections 3, 6, and 10. Make sure your final version keeps them explicit.

Practical steps to make the templates audit-ready:

1. Tie it to your scope. The policy scope should match your AIMS scope statement. If your AIMS covers one product line, say so.
2. Get top management sign-off. A signature from the CEO or equivalent, with date and version.
3. Communicate and record it. Publish internally, collect acknowledgments for the acceptable use policy, and keep the records for clause 7 awareness requirements.
4. Make it available to interested parties. Decide which version customers can see, for example a public summary on your trust page.
5. Cross-reference A.9 and A.3. The acceptable use policy supports the A.9 controls on responsible use and intended use, and section 9 of the governance policy supports A.3.3 on reporting concerns.
6. Log reviews. Keep a simple table: date, reviewer, changes, approver.

See the full list of controls in the Annex A controls guide.

Auditor's note: In audits, the most common gap we look for is a policy that promises more than the company does. If the policy says every AI system gets an impact assessment before release, the auditor will pick a recent release and ask for it. Write only what you can evidence, and add commitments as your processes mature. A modest policy that is followed beats an ambitious one that is not.

Next steps

A policy is the first document an auditor reads and the easiest to get right. The harder work is what it commits you to: the inventory, risk and impact assessments, and the operating governance framework around them.

TrustAIMS, founded by former Big Four auditors, builds these with clients as part of ISO 42001 certification readiness, or reviews your existing policies in a fixed-fee gap assessment. We are not a certification body. To see how your current policies measure up, take the free readiness assessment.