How to write a clear AI policy
Start with decisions, not boilerplate. Identify who and what the policy covers; classify actual activities, data, and consequences; assign human review and disclosure; then name owners, test examples, approve, communicate, and revise the policy.
- Updated:
1. Map scope and rule hierarchy
List the people, work, tools, embedded features, and locations in scope. Include contractors or students where appropriate. Identify existing privacy, security, academic, employment, research, procurement, records, accessibility, and professional rules that still control.
State how organization, department, course, client, and assignment instructions interact. A specific rule can be stricter, but should not quietly override non-negotiable data or legal boundaries.
2. Decide by activity, data, and consequence
Interview people about real tasks: brainstorm, summarize, translate, draft, code, analyze, assess, publish, or decide. Mark each allowed, conditional, approval-only, or prohibited. Then test it against public, internal, confidential, personal, student, customer, and sensitive data.
Apply more scrutiny when output affects grades, employment, eligibility, safety, legal rights, finances, health, or public trust. A tool approved for one low-risk activity is not approved universally.
- Allowed: public-material brainstorming with human verification.
- Conditional: drafting internal material in an approved tool with authorized data.
- Approval-only: a consequential workflow after privacy, security, legal, accessibility, and owner review.
- Prohibited: credentials in prompts, deceptive impersonation, or bypassing safeguards.
3. Write human review, disclosure, and reporting clauses
Say what reviewers must check: claims, citations, calculations, code, bias, safety, rights, accessibility, and fitness for purpose. Avoid “human in the loop” without naming authority and action.
Choose when disclosure is required and provide a truthful format. Example: “I used an approved tool to compare outlines and identify unclear wording. I wrote the final text and checked the sources.” Never pre-populate a declaration as though use occurred.
Give people a reporting route for suspected data exposure, harmful output, rights concerns, and uncertainty. Define a fair review process. In education, context and conversation matter; a detection result must not automatically establish misconduct or a penalty.
Write your policy
4. Assign ownership and rollout
Assign a policy owner, exception approver, reviewer, reporting contact, tool approvers, and record custodian. State implementation tasks without implying that controls already operate.
Pilot the matrix against realistic scenarios. Resolve open decisions, approve the document, communicate role-specific examples, provide training and accessible alternatives, collect acknowledgment where appropriate, and record the adopted version. Review on a maintainable cadence and after material tool, law, incident, contractual, or use changes.
- Confirm scope, owner, authority, and rule hierarchy.
- Review sensitive-data rules and approve tools by use.
- Resolve open decisions and test contradictory scenarios.
- Obtain appropriate legal, privacy, security, HR, academic, accessibility, and records review.
- Approve, communicate, train, implement reporting, and record future reviews when they occur.
Build a draft or compare examples
The generator keeps ordinary drafts readable, editable, and stored in the browser; it does not send policy text to a server-side AI. An explicitly confirmed share sends only the selected public document to temporary snapshot storage. Email is requested only to prepare files, not to read, edit, copy, or share. Start at Free AI Policy Generator. Compare examples at AI Policy Templates, Workplace AI Policy, School AI Policy, University AI Policy, Syllabus AI Policy, and Acceptable Use Policy.
This guide is not legal advice or an expert-reviewed policy. NIST’s framework and playbook offer risk-management prompts; ISO/IEC 42001 describes an AI management-system standard. Citing either does not establish conformity.
Example wording
Clause before and after
Worked decision
Frequently asked questions
Who should write an AI policy?
One owner should coordinate it, but affected operational, user, privacy, security, legal, HR, academic, accessibility, procurement, records, and leadership perspectives should review relevant decisions.
How detailed should activity rules be?
Detailed enough that a person can classify common work without guessing. Use a matrix and examples, plus an approval route for new cases rather than trying to list every product.
How should sensitive information be handled?
Default to not entering it. Permit a narrow use only after the tool, purpose, data class, terms, security, privacy basis, retention, access, and contractual obligations are approved.
What makes an AI policy enforceable in practice?
Clear authority, specific rules, available approved tools, training, accessible alternatives, consistent human review, a reporting route, records, and proportionate existing procedures. Legal enforceability requires jurisdiction-specific advice.
When is the policy finished?
Adoption is a milestone, not an endpoint. Record the approved version, measure whether people can follow it, and update it when evidence or material changes justify revision.
Sources and references
These drafts have not been reviewed by a lawyer or subject-matter expert. Have your legal or policy team review them before use. They are not legal advice or proof of compliance.
NIST describes its AI Risk Management Framework as voluntary guidance for managing AI-related risks and incorporating trustworthiness into AI use.
Use it as a review reference when assigning owners and considering risks, safeguards, and ongoing oversight. This generator does not perform a NIST assessment.
UNESCO’s guidance emphasizes a human-centred approach, data privacy, and age-appropriate use of generative AI in education and research.
For school, university, and classroom policies, review student data, age restrictions, access, and the learning purpose of each permitted activity with the appropriate institutional owners.
Pangram’s classroom-policy article compares blanket restrictions with a tier-based approach that allows different levels of AI assistance for different assignments.
Use the examples to discuss classroom boundaries, then choose your own permissions in the generator. These approaches are options, not a requirement to adopt a particular rule.
Public reference selected for the how to write a clear ai policy page.
Read the original source in its own context. It does not replace qualified local review or establish that this draft is compliant.
Public reference selected for the how to write a clear ai policy page.
Read the original source in its own context. It does not replace qualified local review or establish that this draft is compliant.
Public reference selected for the how to write a clear ai policy page.
Read the original source in its own context. It does not replace qualified local review or establish that this draft is compliant.
References do not imply endorsement.