All services Every engagement has a fixed, published price. Book a strategy call
A complete, free AI policy template that fits on two pages: the five decisions that matter, the full text to copy with no email gate, and how to adapt it for your sector.
Most AI policies are long documents written to reassure a board and never read by the people they govern. Staff meet a thirty page PDF once at induction, forget it by lunch, and paste customer data into a chatbot in week two. The policy that changes behaviour is short enough to remember and specific enough to follow. This guide explains why the long versions fail, sets out the five decisions a working policy must make, and then gives you the full two page template to copy, free, with no email gate.
The short answer. An AI policy people follow fits on two pages and makes five decisions: which AI tools staff may use, which data must never be entered into them, who approves new uses, what to do when something goes wrong, and who owns the policy and reviews it. The complete template is below and may be copied and adapted freely. A policy alone is the start rather than the finish: the register, training and controls behind it are what regulators and customers increasingly ask to see.
Three reasons, all predictable. First, nobody reads them: a policy that takes forty minutes governs nobody after minute five. Second, they ban by vagueness. When staff cannot tell whether a tool is allowed, the confident ones use it quietly and the careful ones lose the productivity, which is the worst of both outcomes and the origin of most shadow AI. Third, they are written for the auditor rather than the user: full of definitions and disclaimers, empty of the two things staff want to know, which are what they may use and what they must never type into it. A two page policy fixes all three, and length discipline forces the real decisions that long documents let organisations avoid.
Permitted tools. Name them. A list of approved tools with named versions beats any abstract principle. Forbidden data. Name that too: customer records, personal data, financial results before publication, credentials, client confidential material. The approval route. One named person or forum that says yes or no to new tools and new uses, within a stated number of days. The incident route. What staff do in the first hour after data goes somewhere it should not, written so that reporting feels safe rather than career ending. Ownership and review. A named owner and a review date, because AI tooling changes quarterly and a policy without a review rhythm is a snapshot.
Copy everything in the box below, replace the bracketed text, delete what does not apply, and keep it to two pages when printed. It is deliberately plain.
Owner: [name, role] Approved: [date] Next review: [date, at most 12 months away]
AI tools help us work faster and better. Used carelessly they can leak confidential data, produce wrong answers we act on, and break laws that apply to us. This policy tells you what you may use, what you must never share, and what to do if something goes wrong. It applies to everyone who works for [organisation], including contractors.
Only these tools, only through organisation accounts. Personal accounts on free tiers are not permitted for work, because free tiers commonly use what you type for training.
You are responsible for anything you send, publish or decide with AI help. Check facts, figures, names and quotations before they leave your hands. Where work is substantially AI produced and goes to a client or regulator, say so if asked. AI output is a draft rather than an authority.
Want to use a new tool, or an approved tool for something sensitive? Ask [named owner or forum] first. You will get a yes, a no, or conditions within [5] working days. Nobody gets in trouble for asking.
If confidential or personal data has gone into an AI tool, or an AI produced error has reached a customer, tell [named person] within one hour of realising. Early reports fix problems and are welcomed. Hiding them makes small problems large.
[Named owner] reviews this policy every [6 or 12] months, updates the tool list, and re circulates it. Suggestions go to [contact].
Regulated sectors should add one section naming the rules that bind them, such as FCA expectations or clinical safety standards, rather than importing the whole rulebook. Organisations in scope of the EU AI Act should note that Article 4 already expects staff working with AI to have adequate AI literacy, which a policy supports and training delivers, with board briefings from £4,500 + VAT. UK GDPR applies to personal data in prompts exactly as it applies everywhere else, which is why section 3 of the template is the one section never to shorten. And organisations building towards certification should treat the policy as one artefact inside an ISO/IEC 42001 management system rather than the system itself.
A policy sets expectations. It does not know which AI systems you run, whether the approved list matches reality, or whether anyone follows section 3 on a Friday afternoon. That is governance, and it needs a register of AI uses, training that reaches everyone, and periodic checks that the paper matches the practice. An AI Governance QuickScan from £15,000 + VAT establishes where you stand, and the wider practice is on our AI governance consulting page. The honest sequence is policy first because it is fast, then evidence, then the controls the evidence says you need.
Five things: the named tools staff may use, the data that must never be entered into them, who approves new tools and uses, what to do when something goes wrong, and a named owner with a review date. Everything else is commentary, and commentary is what stops people reading.
Yes, the full two page template above may be copied and adapted freely, with no email gate. Replace the bracketed text, delete what does not apply, and keep it to two printed pages.
In practice they are the same document under different names. The template above is an acceptable use policy for staff. Larger organisations sometimes add a separate governance policy covering how AI systems are approved, risk assessed and monitored, which belongs with the governance function rather than in the staff document.
The Act does not demand a document called an AI policy, but Article 4 expects organisations to ensure adequate AI literacy in staff working with AI, and high risk systems carry documentation, oversight and data governance duties. A short policy plus training is the practical foundation for both.
Every six to twelve months, and sooner when a major tool changes its terms or a new tool is adopted. AI tooling moves quarterly, so a policy without a review rhythm is out of date by design.
One named senior person, commonly the chief operating officer, the head of IT or the data protection lead in smaller organisations, and the AI governance function where one exists. Ownership by committee is the polite form of ownership by nobody.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
AI Governance
AI Governance