AI Governance Templates for Business Teams

[COMPANY NAME]
AI Acceptable Use Policy
Effective Date: [DATE]
Owner: [ROLE, e.g., Chief Information Security Officer]
Review Cadence: Annually

1. Purpose
This policy defines acceptable use of artificial intelligence (AI) tools by [COMPANY NAME] employees, contractors, and other authorized users. It is intended to enable productive use of AI while protecting company, customer, and third-party information from inappropriate exposure.

2. Scope
This policy applies to all use of AI tools that interact with [COMPANY NAME] data, including:
- Generative AI assistants (ChatGPT, Claude, Microsoft Copilot, Google Gemini, and similar)
- AI features embedded in approved business applications
- AI-powered browser extensions, plugins, and integrations
- Custom AI systems developed internally or by vendors

This policy applies to all employees, contractors, interns, and any third party authorized to access [COMPANY NAME] systems or data.

3. Approved AI Tools
Only AI tools on the approved list maintained by [ROLE/TEAM] may be used with [COMPANY NAME] data. The current approved list is available at [LOCATION]. Adding a new AI tool requires submitting a request through the AI Tool Approval Process described in section 7.

4. Acceptable Use
Employees may use approved AI tools to:
- Draft, edit, summarize, and refine work product
- Research and analyze publicly available information
- Generate ideas, options, and structured plans
- Translate, simplify, or reformat content
- Automate repetitive tasks within their role

5. Prohibited Use
Employees may not:
- Use unapproved AI tools with [COMPANY NAME] data
- Paste sensitive data into consumer-tier AI tools (see section 6)
- Connect AI tools to internal systems without approval
- Share AI-generated content externally without verification of accuracy
- Use AI to bypass internal approval processes (e.g., legal review, expense approval)
- Use AI to generate content that is misleading, defamatory, discriminatory, or unlawful
- Impersonate identifiable individuals, real or fictional, using AI-generated content

6. Sensitive Data and AI
The following categories may not be entered into consumer-tier AI tools under any circumstances:
- Customer personal information
- Employee personal information, performance reviews, or compensation data
- Financial data, revenue, costs, or internal projections
- Source code from proprietary systems
- Active contracts, term sheets, or M&A documents
- Information protected under HIPAA, PCI DSS, or similar regulatory frameworks
- Information covered by third-party non-disclosure agreements
- Internal strategy documents, board materials, or other confidential business records

Enterprise-tier AI tools approved under section 3 may be used with these data categories subject to additional controls defined in the approved tool list.

7. AI Tool Approval Process
To request approval of a new AI tool:
1. Submit a request to [ROLE/TEAM] including the tool name, intended use, data it will access, and vendor information
2. The approval process will evaluate data handling, security posture, vendor stability, and integration scope
3. A decision will be returned within [TIMEFRAME]
4. Approved tools are added to the approved list with any specific use conditions
Employees may not use a tool while approval is pending.

8. Verification of AI Output
AI output may be inaccurate, including fabricated citations, statistics, or facts. Employees are responsible for verifying AI-generated content before using it in external communication, regulatory or audit submissions, legal documents, financial reporting, or public statements.

9. Reporting
Employees must report the following promptly to [ROLE/TEAM]:
- Suspected exposure of sensitive data to an unapproved AI tool
- Suspected AI-generated impersonation of an employee or executive
- Unexpected AI behavior in approved tools (data leakage, hallucinated references to internal data)
- Newly discovered AI features in existing vendor tools

10. Roles and Responsibilities
- All employees: follow this policy, report concerns
- IT/Security: monitors AI tool usage, investigates reported incidents, recommends policy updates
- People Managers: reinforce policy with their teams, model appropriate AI use

11. Enforcement
Violations of this policy may result in remediation, training requirements, or disciplinary action up to and including termination.

12. Exceptions
Exceptions require written approval from [ROLE].

13. Review
This policy is reviewed annually and updated as needed based on changes in AI technology, regulatory environment, and organizational risk tolerance.

Revision History:
[DATE] – Initial version

[COMPANY NAME]
AI Tool Approval Process
Effective Date: [DATE]
Owner: [ROLE]
Standard Decision Timeline: [BUSINESS DAYS]

1. When This Process Applies
This process applies to any AI tool not already on the approved list that an employee or team wants to use with [COMPANY NAME] data.

2. Submitting a Request
Submit AI tool approval requests via [LOCATION OR FORM]. Required information:
- Tool name and vendor
- Vendor's website and primary contact
- The specific use case you want to use the tool for
- The data the tool will access or process
- Whether the tool will be integrated with any internal systems
- The expected number of users
- Pricing tier and contract terms (if known)

3. Review Criteria
3.1 Data Handling
- What data does the tool collect from us?
- Is data used to train the vendor's models?
- Where is data stored? In what jurisdictions?
- What is the data retention policy? Can data be deleted on request?
- Is data encrypted at rest and in transit?

3.2 Security Posture
- Does the vendor have current SOC 2 Type II, ISO 27001, or equivalent attestation?
- Does the vendor publish a pen test summary?
- Does the vendor support SSO and MFA?

3.3 Compliance
- Does the tool meet our applicable framework requirements?
- Is the vendor willing to sign a Business Associate Agreement (BAA) if required?
- Are there geographic data residency requirements we must meet?

3.4 Integration Scope
- Will the tool connect to other systems? Which ones?
- What permissions does that connection require?

3.5 Operational Considerations
- How long has the vendor been in business?
- What is their customer base?
- What is the cost over a 2-year horizon?

4. Decision Categories
4.1 Approved – Standard Use: added to the approved list with no specific conditions.
4.2 Approved – Conditional Use: added with specific conditions (data type limits, integration limits, monitoring requirements).
4.3 Declined: not added; reasoning documented and communicated to requester.
4.4 Need More Information: request returned to requester or routed to the vendor for follow-up.

5. Documentation
Every request and decision is documented and retained for audit purposes. Documentation includes original request, review evaluation against criteria, final decision and reasoning.

6. Re-Review
Approved tools are re-reviewed at least annually, when vendor's data handling changes, when significant new features (especially AI features) are added, or when the use case changes materially. A tool may be removed from the approved list at any time if circumstances change.

7. Exceptions
In exceptional cases (active incident response, critical business need), expedited approval may be requested with [ROLE] sign-off. Expedited approvals are reviewed under the standard process within [TIMEFRAME].

[COMPANY NAME]
AI Use Case Risk Assessment

Use Case Name: [DESCRIPTIVE NAME]
Use Case Owner: [ROLE/NAME]
Risk Tier: [1 / 2 / 3]
Assessment Date: [DATE]
Assessor: [ROLE/NAME]
Next Review: [DATE]

1. Use Case Description
Describe what the AI tool will do, who will use it, and what business outcome it supports.

2. Data Involved
- Data inputs: [WHAT DATA GOES INTO THE TOOL]
- Data outputs: [WHAT DATA THE TOOL PRODUCES]
- Data classification: [PUBLIC / INTERNAL / CONFIDENTIAL / REGULATED]

3. Decision-Making Impact
Does the AI make decisions or generate recommendations affecting:
- Employees (hiring, performance, compensation)?
- Customers (account decisions, service levels, eligibility)?
- The public (information accuracy, fairness)?

4. Risk Dimensions
For each, capture: Risk Level / Controls in place / Residual Risk.
4.1 Data Exposure Risk
4.2 Accuracy and Hallucination Risk
4.3 Vendor Risk
4.4 Regulatory and Compliance Risk
4.5 Bias and Fairness Risk (when affecting people)
4.6 Operational Risk (what happens if the AI tool becomes unavailable?)
4.7 Reputational Risk

5. Mitigation Plan
For each residual risk above an acceptable threshold, define the mitigation, owner, and target date.

6. Monitoring
What metrics or signals will indicate problems? Who reviews those signals, and how often? When is the next scheduled review of this assessment?

7. Approval
Approved by: [NAME, ROLE]
Approval Date: [DATE]
Conditions of Approval: [LIST]