# [Organization name]: AI use policy

> For reference purposes only. Not legal advice. Draft for review by a qualified professional.

**How to use this template.** Replace every `[placeholder]` with your own text, delete guidance notes in italics, and have your legal team review the result before approval. Keep the policy short enough that people read it. Template version 1.0, last reviewed 2026-10-02. Certainty: simplified. This is a general starting point; rules differ by region.

| Field | Entry |
|---|---|
| Document title | AI use policy |
| Document ID | [POL-AI-001] |
| Version | [v1.0] |
| Prepared by | [Name and role] |
| Approved by | [Name and role] |
| Last revision | [Date] |
| Review cycle | [Every 12 months, and whenever relevant laws change] |

## 1. Purpose

This policy sets out how [Organization name] chooses, builds, buys and uses AI systems responsibly and in line with the law.

## 2. Scope

This policy applies to everyone who works for or on behalf of [Organization name], and to every AI system we build, buy or use. *Optional: name business units or systems, and name the environments covered.*

## 3. Roles and owner

- [Owner role] is accountable for this policy.
- Every AI system has a named owner who is responsible for its use and review.
- [AI governance group] reviews new and higher-risk uses. It meets [how often] and escalates to [role].

## 4. Permitted and prohibited uses

- Permitted: [list approved uses and approved tools, or the location of the approved-tools list].
- Prohibited: [list uses that are not allowed, for example uses that could fall under practices banned by law].
- New AI uses must be submitted through the intake process before they are built, bought or used.

## 5. Risk tiers and approval

Each AI system is placed in a risk tier using written criteria. Higher-risk uses need approval from [Approver role] before launch, and a record of the decision, any conditions and the next review date.

## 6. Human oversight

Decisions that significantly affect people are reviewed by a trained person who has the time, information and authority to change or stop them.

## 7. Data and privacy

Do not enter [restricted data types] into any AI tool that is not approved for that data. Collect only the data needed for the stated purpose and keep it no longer than needed.

## 8. Transparency

We tell people when they are interacting with an AI system or seeing AI-generated content, where this is required or expected.

## 9. Vendor AI

AI suppliers are assessed before purchase and contracts include AI-specific terms covering data use, incident notice, audit rights and exit.

## 10. Training

Everyone completes [required training] within [time period] of joining, and refreshes it every [period].

## 11. Incident reporting

Report any AI problem, near miss or concern to [reporting route] as soon as you notice it.

## 12. Review and enforcement

This policy is reviewed every [review cycle] and whenever relevant laws change. Breaches are handled under [disciplinary or escalation process].

## 13. Region notes

*Keep only the regions that apply.* Additional requirements may apply in the EU, the US, the UK and India. See the ClearPath region pages and confirm with counsel.

## Approval

| Role | Name | Signature | Date |
|---|---|---|---|
| Executive sponsor | [Name] | | |
| AI governance lead | [Name] | | |

---

For reference purposes only. This site offers general guidance for learning and planning; it is not legal advice and creates no lawyer-client relationship. Rules change often, so check the primary sources and qualified counsel before you act.