AI Governance Policy Template

A practical starting template for documenting how an organisation governs the use of AI.

1. Purpose

This policy establishes the organisation's approach to governing the use of artificial intelligence. It defines responsibilities, approval expectations, oversight activities and review requirements.

2. Scope

This policy applies to AI systems and AI-enabled services used, purchased, developed or operated by the organisation, including relevant third-party AI services.

3. AI governance responsibility

AI governance is owned by [role / person]. Management oversight is provided by [role / management group]. Relevant legal, privacy, security or operational specialists are consulted where appropriate.

4. Acceptable AI use

Employees may use approved AI systems for legitimate business purposes provided they follow applicable organisational policies, data handling requirements, security controls and human oversight requirements.

5. Restricted or prohibited use

The organisation should define AI uses that require additional approval or are not permitted. Examples may include uses involving sensitive information, high-impact decisions, unauthorised automated decisions or activities that conflict with legal or organisational requirements.

6. AI use case approval

Significant AI use cases should be reviewed before deployment. The review should consider the purpose, affected people, data involved, material risks, human oversight, security considerations and relevant third-party dependencies.

7. Human oversight

Where AI outputs may materially affect people, customers, employees or important business decisions, appropriate human oversight should be defined and maintained.

8. Monitoring and incidents

AI-related incidents, material issues and significant changes should be recorded, assessed and escalated according to the organisation's incident and governance processes.

9. Records and evidence

The organisation should retain appropriate records of significant AI use cases, approvals, reviews, incidents, decisions and policy updates.

10. Policy review

This policy should be reviewed periodically and whenever significant changes occur to the organisation's AI use, regulatory environment, risk profile or operating model.

11. Approval

Policy owner: [name / role] Approved by: [name / role] Approval date: [date] Next review date: [date] Version: [version]

IMPLEMENT

Practical actions

Replace the placeholders with organisation-specific roles and responsibilities.
Define which AI use cases require management approval.
Add relevant data, privacy and security requirements.
Define the review frequency.
Obtain appropriate internal approval before publishing the policy.

EVIDENCE

Evidence to prepare

Approved AI governance policy
Policy version history
Approval record
Scheduled review record

ASSESSMENT CONNECTION

Start the free AI Governance Assessment

Assess your current governance practices and receive a personalised learning and action plan.

Start Free Assessment

These resources are provided for educational and planning purposes. They are not legal advice, an audit, a certification, or a determination of compliance. Organisations seeking ISO/IEC 42001 certification should work with an appropriately accredited certification body.