Your team started using AI months ago. Nobody told them the rules.
Someone in finance is pasting spreadsheets into ChatGPT. Someone in marketing is drafting customer emails in Copilot. None of it is malicious, and none of it is written down anywhere.
Then a customer sends an AI questionnaire, or your insurer asks what controls you have, and you have nothing to show them.
This policy is what you show them — and more importantly, it is what your staff actually follow.
Why pay for this when free templates exist
Free templates are written to generate leads, so they are built to look thorough rather than to be adopted. They arrive at forty pages of principle with no approval workflow, no data classification tied to your own tiers, and no answer to the question staff actually ask: can I use this tool, for this, right now?
This one is twelve pages because that is the length a policy gets read at. Every section is written to be actioned by a person who is not a lawyer, on a Tuesday, under time pressure.
It is also written by a practising GRC advisor — LL.B, CISM, CISA, CIPP/E, CIPP/US — who has watched policies fail in real organizations and knows which clauses cause the failure.
What’s included
- AI Acceptable Use Policy — the core document, 12 pages, fully editable
- Approved and prohibited use guidance — concrete examples, not abstract principles
- Data classification rules — what may and may not be entered into an AI tool, by data tier
- Tool request and approval workflow — so new tools get reviewed instead of adopted quietly
- Human oversight requirements — where a person must check output before it reaches a customer or a decision
- AI output verification standards
- Incident reporting procedure — what staff do when something goes wrong
- Employee acknowledgement form — your evidence that the policy was communicated
- One-page implementation note — who approves it, how to roll it out, what to review at 90 days
Mapped to NIST AI RMF, ISO/IEC 42001, and EU AI Act Article 4 (AI literacy), so you can show an auditor where each requirement is met.
Who it’s for
Organizations rolling out ChatGPT, Microsoft Copilot, Google Gemini, Claude, or any other AI tool to staff — typically small and mid-sized businesses, professional services firms, and startups that need something defensible in place this week.
Who should buy something else
Buying the wrong thing wastes your money and my time, so:
- You need the full program — inventory, risk assessment, vendor questionnaire. Look at the AI Governance Starter Kit instead, from $299, tailored to your organization.
- You face EU AI Act obligations as a provider or deployer of high-risk systems. You need the EU AI Act & ISO 42001 Toolkit.
- You handle Controlled Unclassified Information or work toward CMMC. That is a different document set, delivered through cyberdsc.com.
Practical details
- Format: Microsoft Word (.docx), fully editable
- Length: 12 pages
- Delivery: instant download after checkout
- Licence: one organization, unlimited internal use
- Editing time: about an hour — bracketed fields mark everything organization-specific
- Last reviewed: August 2026
Questions before you buy
Do I need a lawyer to review it?
For most organizations, no. It is an internal policy, not a contract. If you operate in a heavily regulated sector or across several jurisdictions, have counsel look at it. This is not legal advice.
Can I get it tailored to my organization instead?
Yes. The AI Governance Starter Kit includes this policy adapted to your sector, size, and risk profile, plus four more documents that work with it.
What if it isn’t what I expected?
Digital downloads are non-refundable once delivered, but email info@aigrcadvisory.com and I would rather fix it than keep your money.
Reviews
There are no reviews yet.