Explainer

What to put in an AI policy

Written with AI from the sources below and checked against our facts sheet. Last checked 7 Nov 2026. How this site is made · Spot an error?

Part of: ISO/IEC 42001, NIST AI Risk Management Framework

An AI policy is the document that sets an organization's rules for building, buying and using AI. A good one names who is accountable and defines approved and prohibited uses. It requires risk triage and review before launch, and sets rules for data, vendors, monitoring and incidents. It usually sits beside an acceptable use policy for staff and AI updates to existing privacy, security and IP policies.

In short

Cover the whole life cycle: intake, risk, data, development, testing, deployment, monitoring, incidents and retirement.
Name owners: an accountable executive, a committee and a business owner for each AI system.
Pair it with an acceptable use policy that tells staff which tools and inputs are allowed.
Update existing privacy, security, data governance, IP, HR and procurement policies instead of duplicating them.
Review it on a schedule and whenever AI enters a program, a new AI program launches or a new law applies.

What is an AI policy?

An AI policy is the organization's rulebook for AI. It turns principles such as fairness, transparency and accountability into requirements people can follow and auditors can check.

It sits inside a wider AI governance framework, alongside roles, committees, inventories and controls. The policy states the rules. The framework makes them work.

Most organizations need two documents. The AI policy governs how the organization builds, buys and deploys AI. The acceptable use policy governs how individual staff use AI tools.

What should an AI policy include?

The sections below follow the AI life cycle. Each needs an owner and a checkpoint, not one big review the week before launch.

Section	What it says
Purpose and scope	Which AI the policy covers (built, bought, embedded in vendor tools) and who must follow it
Definitions	What counts as AI, using a recognized definition such as the EU AI Act's or the OECD's
Principles	The values the organization commits to, such as fairness, safety, privacy, transparency and accountability
Roles and accountability	The executive owner, the committee, system owners, specialist functions and internal audit
Use-case intake and risk tiers	One front door for new AI uses, triage criteria and the review each tier needs
Prohibited and restricted uses	Banned uses, including any Art. 5 practices, and uses that need extra approval
Data rules	Rights to use data, provenance, quality, minimization, retention and special-category data
Development and testing	Documentation, secure development, acceptance criteria set before testing, bias and adversarial testing
Procurement and vendors	Due diligence, AI-specific contract terms, license checks and ongoing vendor monitoring
Deployment and human oversight	Go or no-go gate, approved uses, who can override or stop a system
Monitoring	Performance, drift, fairness and misuse checks, with thresholds that trigger action
Transparency and documentation	AI inventory, model cards, notices to users and affected people, decision records
Incidents	How to report, contain and escalate AI incidents, linked to the incident plan
Training	Role-based AI training and awareness for everyone affected
Exceptions and enforcement	Who can grant an exception, how it is recorded, consequences of breaches
Review	Review schedule and the events that trigger an immediate review

Two rules make the policy credible. Deactivation triggers should be regulatory or performance problems, never profit or "a newer version exists." Every approval, condition and exception should be written down, because records are how governance proves itself.

What goes in an AI acceptable use policy?

An acceptable use policy binds employees, contractors and anyone using AI on the organization's behalf. It usually covers:

Approved tools, and how to request a new one.
Prohibited inputs: client confidential data, personal data, trade secrets and regulated data in unapproved tools.
Prohibited uses, such as impersonation, or decisions about people without approval.
Human review before AI output is relied on or shared externally.
Disclosure of AI-generated content where required, including deepfakes under Art. 50(4) of the EU AI Act.
Company accounts and settings, not personal accounts.
Logging, reporting and consequences, enforced through HR.

An acceptable use policy is the main defense against shadow AI, meaning staff using tools nobody approved. It works best paired with an easy route to request new tools.

Which existing policies need AI updates?

The best practice is to retrofit, not reinvent. Run a gap analysis of existing policies against AI's traits: training data, probabilistic outputs, new attack types, generated content and autonomy. Each policy's current owner updates it.

Policy	AI-era additions
Privacy	Notices about AI use, lawful basis for training, impact assessments, rights requests that reach trained models
Security	Prompt injection, data poisoning, model theft, protecting model weights, the AI supply chain
Data governance	Training-data provenance and lineage, labeling standards, representativeness, synthetic data
Intellectual property	Rights to train on content, ownership of outputs, open-source model licenses
HR	Fair use of AI in hiring, monitoring and evaluation; notice to workers; human review
Procurement	AI due diligence questions, data-use limits, change notices, audit and testing rights

Updating in place keeps one source of truth and avoids an "AI policy" that contradicts the privacy policy.

How does an AI policy map to laws and frameworks?

The EU AI Act does not mandate a document called an AI policy. Several duties read naturally into one:

AI literacy for staff, now framed as taking measures to support it (Art. 4, as amended by the Digital Omnibus);
the prohibited practices in Art. 5, which belong on the banned-uses list;
deployer duties for high-risk systems in Art. 26, applying from 2 December 2027;
Art. 50 transparency duties for chatbots and deepfakes, applying since 2 August 2026.

The NIST AI RMF puts policy at the center of its GOVERN function. GOVERN 1 expects policies, processes, procedures and practices for mapping, measuring and managing AI risks. GOVERN 6 adds policies for third-party software, data and supply chain risks.

ISO/IEC 42001 requires top management to establish an AI policy as part of its leadership clause. Annex A also includes a control area on AI policies. For certification, the policy must exist, be communicated and be reviewed.

When should you review an AI policy?

Review it on a schedule, often yearly. Three events call for an immediate, out-of-cycle review:

AI is introduced into an existing program, such as a personalization engine added to a loyalty scheme.
A new AI program launches, such as an AI hiring tool.
The organization becomes subject to a new law, such as Colorado's AI Act from 1 January 2027 (see the Colorado AI Act hub).

Incidents, audit findings and major model changes can also prompt updates. Minor changes, such as renaming a department, can wait for the normal cycle.

How does the AIGP exam test AI policies?

Policies at every life-cycle stage. One ethics review the week before launch is the wrong answer.
Retrofit, don't duplicate. Updating the privacy policy beats writing a separate AI rulebook that overrides it.
Match the instrument to the party. Staff conduct belongs in the acceptable use policy and vendor conduct in the contract. Decisions about workers belong in HR policy.
Know the three review triggers. AI added to a program, a new AI program, a new law.
Valid deactivation triggers are regulatory or performance issues, never profit.

Practice in lessons I.C.1 (plan and design), I.C.2 (build to retirement), I.C.3 (updating policies), I.C.4 (procurement) and I.C.5 (HR and acceptable use).

Frequently asked questions

What is the difference between an AI policy and an AI acceptable use policy?

An AI policy governs how the organization builds, buys and deploys AI: accountability, risk tiers, reviews, data, vendors, monitoring and incidents. An acceptable use policy governs how staff and contractors use AI tools day to day. It covers approved tools, forbidden inputs, human review of outputs and reporting. Most organizations need both, and the AI policy points to the acceptable use policy.

Does the EU AI Act require an AI policy?

Not by name. Its duties are easier to meet with one, though. Every provider and deployer must take measures to support staff AI literacy (Art. 4). Prohibited practices in Art. 5 belong in a policy's banned-uses list. High-risk providers need a documented quality management system (Art. 17), and deployers need human oversight and monitoring (Art. 26). ISO/IEC 42001 does require an AI policy.

How often should an AI policy be reviewed?

On a regular schedule, often yearly, and immediately when a trigger occurs. Three triggers call for an out-of-cycle review. AI is introduced into an existing program, a new AI program launches, or the organization becomes subject to a new law. Incidents and audit findings can also prompt changes.

Who should approve an AI policy?

Senior leadership, usually on the recommendation of the AI governance committee. The board or a board committee typically sets AI risk appetite. A named executive owns the policy and its updates. Each section's owner, such as privacy, security or procurement, keeps their part aligned with the policies they already run.

Sources

Spot an error? Tell us