An acceptable use policy tells staff how to use AI tools, but it does not say who may approve an AI system, what evidence is needed before it goes live, or who is accountable when it goes wrong. That is the job of the AI governance policy: the top-level document that sets principles, assigns roles and requires controls at each stage of the AI lifecycle, from intake to retirement. This template is written to serve as the AI policy required by ISO/IEC 42001 and to satisfy the NIST AI RMF GOVERN function, while working for organisations that build, buy or simply use AI. Staff behaviour rules stay in the AI Acceptable Use Policy Template, and agent identity rules in the Agentic AI Security Policy Template; this policy sits above both. Have it reviewed by your legal, risk and compliance teams before adoption.
How to use this template
- Replace placeholders: text in square brackets, such as [Organisation], [AI Governance Committee] and [Accountable Executive], with your own names and roles.
- Keep the language of obligation: "must" is mandatory; "should" is expected practice where a documented exception may be justified.
- Set your own tiers and thresholds: the risk tiers and review periods in sections 6 and 7 are starting points; align them with your enterprise risk framework and appetite statements.
- Keep the policy short and stable: put procedures, forms and technical standards in linked documents (section 12) so the policy needs board approval only when principles or roles change.
- Approve at the right level: ISO/IEC 42001 expects top management to establish the AI policy; have it approved by the board or the executive committee and record the approval.
1. Purpose
1.1 This policy sets out how [Organisation] governs the development, procurement, deployment and use of artificial intelligence so that AI is used lawfully, safely, securely and in line with [Organisation]'s values and risk appetite.
1.2 It establishes the principles all AI activity must follow, the roles accountable for AI risk, and the controls required at each stage of the AI lifecycle.
1.3 It provides the framework for setting AI objectives and is the AI policy of [Organisation]'s AI management system.
2. Scope
2.1 This policy applies to all employees, contractors and third parties acting for [Organisation], and to every AI system [Organisation] develops, procures, deploys or uses, including:
- models and AI systems built or fine-tuned in house;
- AI features inside purchased software and SaaS products;
- general-purpose AI services and assistants used for work;
- AI agents that take actions on systems or data, whether built or bought;
- AI provided by [Organisation] to customers or partners.
2.2 [Organisation]'s role for each system (for example provider, deployer, importer or user under applicable law) must be recorded in the AI register, because obligations differ by role.
3. Definitions
- AI system: [Adopt the definition used by the law that applies to you, for example Article 3(1) of the EU AI Act, or the OECD definition.]
- AI agent: an AI system that can plan and take actions through tools, APIs or credentials with limited human direction.
- AI register: the authoritative inventory of AI systems in scope of this policy.
- Risk tier: the classification of an AI use case under section 6.
- Material change: a change to an AI system's model, purpose, data, users, autonomy or supplier that could alter its risk.
- AI incident: an event in which an AI system caused or nearly caused harm, a legal breach, a security compromise or a significant failure.
4. Principles
4.1 All AI activity at [Organisation] must follow these principles. They reflect the characteristics of trustworthy AI in the NIST AI RMF: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed.
- Accountability: every AI system has a named business owner who is accountable for its outcomes.
- Lawfulness: AI is used only for purposes that comply with applicable law, contracts and [Organisation] policy.
- Proportionate oversight: the level of review, testing and human oversight increases with the risk tier.
- Human authority: people with the competence and authority to intervene can review and override AI that significantly affects individuals.
- Transparency: people are told when they interact with AI or are subject to an AI-assisted decision, where law or fairness requires it.
- Security and privacy by design: AI systems, their data and the identities they use are protected to the same standard as other critical systems.
- Fairness: AI that affects people is assessed for harmful bias before and after deployment.
- Least autonomy: AI agents receive only the access and autonomy their approved purpose requires.
5. Roles and responsibilities
| Role | Responsibilities |
|---|---|
| [Board or delegated committee] | Approves this policy and the AI risk appetite; receives AI risk reporting at least [half-yearly]; decides on risks above tolerance. |
| [Accountable Executive] | Owns the AI management system; chairs or sponsors the [AI Governance Committee]; accepts residual risk for the highest tier. |
| [AI Governance Committee] | Approves high-risk use cases, exceptions and standards; reviews incidents and KRIs; includes legal, privacy, security, risk, data and business members. |
| [AI Governance Lead] | Maintains the AI register, procedures and templates; runs the programme health check; reports to the committee. |
| AI system business owner | Accountable for the system's purpose, risk assessment, oversight, monitoring and retirement. |
| Technical owner | Builds or configures the system, maintains documentation, testing and monitoring, and manages its identities and credentials. |
| [Legal and Privacy] | Confirms legal role and obligations; leads impact assessments involving personal data. |
| [Information Security] | Sets AI security standards; reviews AI threat models; handles AI security incidents. |
| [Procurement and Third-Party Risk] | Ensures AI in purchased products is declared, assessed and contracted under section 9. |
| [Internal Audit] | Provides independent assurance over the AI management system. |
5.2 No individual may both approve and be the business owner of the same high-risk AI system.
6. Risk classification
6.1 Every AI use case must be assigned a risk tier before approval and again after any material change.
| Tier | Typical examples | Approval | Minimum controls |
|---|---|---|---|
| Prohibited | Uses banned by law or by [Organisation] (for example practices prohibited by Article 5 of the EU AI Act) | Not permitted | None: do not proceed |
| High | Decisions about employment, credit, access to services; safety components; agents with write access to critical systems | [AI Governance Committee] | Impact assessment, testing, human oversight design, monitoring plan, annual review |
| Medium | Customer-facing assistants; internal decision support; agents with read access to confidential data | [AI Governance Lead] and business owner | Risk assessment, testing, monitoring plan, review every [18] months |
| Low | Productivity tools on approved platforms with non-confidential data | Business owner via standard intake | Registration and acceptable use rules |
7. Lifecycle controls
7.1 Intake: every new AI use case, including AI features enabled in existing products, must be submitted through the [AI use case intake process] and entered in the AI register before use.
7.2 Assessment: medium and high tier use cases must have a documented risk assessment covering intended purpose, affected people, data, security threats, legal obligations and third parties. High tier use cases must also have an impact assessment on individuals and groups.
7.3 Design and data: training, fine-tuning and retrieval data must have a recorded source, lawful basis where personal data is used, and quality checks proportionate to the tier.
7.4 Testing: before release, medium and high tier systems must be tested against acceptance criteria for accuracy, robustness, security (including prompt injection and data leakage) and, where people are affected, bias. Results must be recorded.
7.5 Approval: no AI system may go live without approval at the level in section 6 and a completed system record (purpose, owner, tier, limitations, test results).
7.6 Identity and access: each AI agent and AI service must have its own identity, a named owner, least-privilege access and credentials managed under [Organisation]'s identity and secrets standards. Irreversible or external actions require an approval step or a pre-approved policy.
7.7 Human oversight: high tier systems must have a documented oversight design naming who reviews outputs, how they can override or stop the system, and how they are trained.
7.8 Monitoring: medium and high tier systems must have a post-deployment monitoring plan with thresholds for performance, drift, misuse and security events, and logs retained for at least [six months] or longer where law requires.
7.9 Change: material changes must be re-assessed and re-approved at the tier level before release.
7.10 Retirement: AI systems must be decommissioned through a documented process that revokes identities and credentials, handles data and models under retention rules, and updates the register.
8. Incidents and concerns
8.1 Anyone who suspects an AI incident must report it through [incident reporting channel] without delay.
8.2 AI incidents must be handled under the [incident management procedure], with the [AI Governance Lead] informed. Legal must assess whether an external reporting obligation applies, for example serious incident reporting under Article 73 of the EU AI Act, data breach notification or sector rules, and the deadline that runs from awareness.
8.3 Where a system may present a risk, its business owner must have authority to suspend it pending review.
8.4 Concerns about AI use may also be raised through [whistleblowing channel] without fear of retaliation.
9. Third-party AI
9.1 Suppliers must declare AI used in products and services provided to [Organisation], including material changes to that AI.
9.2 Third-party AI must be assessed under the [third-party risk procedure] with AI-specific questions on data use, model training on customer data, security, incident notification and location of processing.
9.3 Contracts for medium and high tier third-party AI must address data use restrictions, incident notification, audit or assurance rights, and exit.
10. Training and AI literacy
10.1 [Organisation] must take measures to ensure staff and others operating or using AI on its behalf have sufficient AI literacy for their role, as Article 4 of the EU AI Act requires of providers and deployers.
10.2 Business owners, technical owners, oversight staff and committee members must complete role-specific training before taking up the role and every [12] months.
11. Exceptions, compliance and enforcement
11.1 Exceptions must be requested in writing, risk-assessed, approved by the [AI Governance Committee] for high tier systems or the [AI Governance Lead] otherwise, recorded in the exception register and time-limited to no more than [12] months.
11.2 Compliance with this policy will be monitored through the AI register, the programme health check and internal audit, and reported to the [Board or delegated committee].
11.3 Breaches of this policy may lead to disciplinary action and, for third parties, contractual remedies.
12. Related documents
- AI acceptable use: AI Acceptable Use Policy Template
- AI agents: Agentic AI Security Policy Template
- Intake: AI Use Case Intake Form Template
- Register: AI Register and AI Inventory Template
- Impact assessment: AI Impact Assessment Template
- Incidents: AI System Incident Report Template
- Suppliers: AI Vendor Security Questionnaire Template
- Training: AI Literacy Training Plan Template
13. Review
13.1 The [AI Governance Lead] must review this policy at least annually, and after any significant change in law, AI technology, risk appetite or a major AI incident.
13.2 Version: [x.x]. Approved by: [Board or delegated committee]. Approval date: [date]. Next review: [date].
Implementation guidance
- Inventory first: build the AI register before the policy goes live, including AI inside SaaS products, or the scope in section 2 cannot be enforced.
- Calibrate tiers: test the section 6 tiers against ten real use cases and adjust examples until owners classify consistently. See the AI Use Case Risk Tiering Guide.
- Stand up the committee: agree terms of reference, quorum and a decision log. See the AI Ethics Board and AI Review Committee Guide.
- Pilot with one business unit for a quarter, track approval lead times, then roll out across the organisation.
- Measure it: report KRIs to the board with the AI Governance Metrics guide and check operation with the AI Governance Programme Health Check.
| Policy section | ISO/IEC 42001:2023 | NIST AI RMF 1.0 | EU AI Act |
|---|---|---|---|
| 1, 4 Purpose and principles | Clause 5.2 AI policy | GOVERN 1.2 | None directly |
| 5 Roles | Clause 5.3 roles, responsibilities and authorities | GOVERN 2.1, GOVERN 2.3 | Article 26(2) oversight staff |
| 6 Risk classification | Clause 6.1 actions to address risks | GOVERN 1.3, MAP 1.1 | Article 5, Article 6 |
| 7 Lifecycle controls | Clause 8 operation; AI system impact assessment | GOVERN 1.6, GOVERN 1.7, MANAGE 4.1 | Article 26 |
| 8 Incidents | Clause 10 improvement | GOVERN 4.3, MANAGE 4.3 | Article 73 |
| 9 Third-party AI | Annex A.10 third-party and customer relationships | GOVERN 6.1, GOVERN 6.2 | None directly |
| 10 Literacy | Clause 7.2 competence | GOVERN 2.2 | Article 4 |
Map the policy to NIST CSF 2.0 GV.PO-01 and GV.PO-02 if your security policy framework already uses it.
This template is provided for guidance and must be adapted to your organisation. It is not legal advice. Related NHI Mgmt Group resources: AI Governance Guide · NIST AI RMF vs ISO/IEC 42001 · ISO 42001 Readiness Checklist · Third-Party AI Risk Guide