AI Policy Generator

The audience determines which activities and responsibilities appear in the policy. Choose the people the policy governs, not the person writing it.

• University: institution-wide academic and research use. School: K–12 students and staff. Teacher: one class or syllabus.
• Company: employees and workplace use. Publisher: writers, editors, and contributors.

Enter the institution, employer, school, or publishing team adopting the policy. The generator inserts this name in the draft. If you leave it blank, the draft uses a generic description.

Example: For a school-wide policy, enter the school’s name. Use Policy Scope to limit the policy to a department.

Scope sets where the policy applies: an entire organization, a department, one course, or a publication. A narrower policy remains subject to any controlling organization-wide rules.

Example: A course AI policy may restrict assessed work without replacing university-wide privacy or research requirements.

Enter the places where the policy will apply so reviewers can check local obligations. This field provides context only; it does not tailor the draft to a jurisdiction, give legal advice, or establish compliance.

Example: A team operating in several countries can list those countries for its legal or privacy reviewer.

Name the class covered by a course-level policy or syllabus statement so students can distinguish it from other course rules.

Example: English 101 — Academic Writing, Fall term.

Select the learners’ level. When reviewing the draft, account for their age, learning objectives, supervision, and access.

Example: For younger students, review tool age requirements and school privacy arrangements separately; this selection does not check them.

Enter the organization’s sector as context. This field does not change the policy clauses. Add any sector-specific rules and arrange a separate compliance review where needed.

Example: A healthcare organization should separately review patient information restrictions and the suitability of each AI tool.

Using third-party tools means working with an existing service. Building AI systems includes developing or integrating models and AI-enabled products. Choose Both if both apply.

• Tool use requires approved accounts, data limits, and human review.
• System development may also require testing, monitoring, vendor review, and further governance.

Select the approximate size of the organization or group covered by the policy. This field provides context only; it does not change the clauses or assign responsibilities.

Example: A small team may assign several responsibilities to one role; a larger institution may need separate owners and reviewers.

The default rules set initial activity rules. They do not decide every use. Review each rule in the permission matrix.

• Restricted: AI use is prohibited unless a documented exception applies.
• Permission Based: AI is allowed for specified activities under stated conditions.
• Broadly Allowed: approved AI use is encouraged within defined limits; use is not unrestricted.

The permission matrix sets a rule for each activity. Permission for an activity does not approve a particular tool or data type.

• Allowed: permitted under the policy’s general safeguards.
• Allowed with conditions: permitted only when every listed condition is met.
• Approval required: obtain authorization before proceeding.
• Prohibited: do not use AI for this activity.

Example: Brainstorming may be allowed while publishing an AI-assisted statement requires review and approval.

Conditions are requirements attached to an activity, such as using an approved tool, excluding personal information, or checking factual claims. Write each requirement so users and reviewers can verify it.

Example: For AI-assisted research: verify citations against the original sources before using the output.

Use this field to define an activity rule’s boundary or explain a documented exception. State the exception’s limits and who may approve it. Do not use it to contradict the selected permission.

Example: A manager may approve a limited pilot using public sample data; customer records remain excluded.

List the services, account types, or managed environments the organization has approved. A product name alone does not approve every feature, account, task, or data category.

• Separate tool names with commas.
• Leaving the list blank keeps tool approval case-by-case; it does not authorize every AI service.

Example: Specify an organization-managed account rather than assuming a personal account has the same protections.

This setting controls whether instructors may set assignment-specific rules. “Within institutional authority” means they may change defaults only where the institution allows it.

• No overrides allowed: assignment rules cannot replace these defaults.
• Within institutional authority: instructors can specify task rules without overriding higher-level privacy, security, or academic requirements.

Example: An instructor may prohibit AI drafting for an essay even if brainstorming is generally allowed.

Data handling rules specify what users may enter into approved tools. Selecting a category does not replace privacy review, contractual restrictions, or permission to use particular records.

• Public Information: material legitimately available to the public. Internal Drafts: non-public work in progress.
• Confidential Data: business or institutional information requiring restricted access. Personal Information: information that identifies or relates to a person.
• Student Records: learner information and education records. Customer Data: information obtained from or about customers.
• Do not enter credentials, secrets, or protected health data into general-purpose AI tools.

Disclosure tells readers, instructors, clients, or reviewers when AI contributed to the work. It does not replace verification or make a prohibited use acceptable.

• Always required: disclose any AI assistance.
• Only for substantive generation: disclose meaningful AI-created text, ideas, analysis, code, or other content, rather than routine minor assistance.
• For external or assessed work: disclose AI assistance in material shared outside the organization or submitted for assessment.
• According to specific assignment rules: follow an identified task or assignment requirement. State that rule clearly.

Example: “AI was used to draft an outline. I checked the sources and wrote the final text.”

State what the disclosure must include, where it belongs, and when it is required. Explain the selected disclosure setting without contradicting it.

• If you select “According to specific assignment rules,” complete this field so readers know which rule to follow.

Example: Add a note at the end identifying the AI tool, what it helped with, and who reviewed the result. If prompts are required, exclude confidential or personal information.

Training teaches people how to follow the policy. Policy review checks whether the rules still fit the organization’s tools, activities, and risks. Set each separately.

Example: Train new staff before AI use, provide a yearly refresher, and review the policy every six months.

Require people to learn the rules when they join or before they use approved tools. Cover permissions, restricted data, disclosure, human review, and where to ask questions.

Example: A new employee reviews the policy and practices deciding which information can be included in an AI prompt.

An annual refresher reviews the rules and explains important changes to existing users. It does not set the schedule for reviewing the policy itself.

Example: Use a yearly session to discuss new tools, common mistakes, and updated disclosure expectations.

Choose whether the policy owner should formally reassess the policy quarterly, every six months, or annually.

• Review sooner after an incident, a significant tool change, or a material change in obligations.
• Selecting a frequency records an expectation in the draft; the generator does not schedule meetings or send reminders.

Assign separate responsibilities for maintaining the policy, approving tools and exceptions, reviewing outputs, and handling reports. The reporting contact is the channel people use; the reporting role handles the reports.

Example: An owner maintains the policy, an approval role authorizes exceptions, a reviewer checks AI-assisted work, and a designated team handles reports.

The owner maintains the policy, coordinates implementation, and oversees policy reviews. Enter a role or title rather than a person’s name so responsibility remains clear when staff change.

Example: Head of IT, Principal, Research Governance Lead, or Managing Editor.

The approver authorizes tools, proposed uses, and documented exceptions. This role is distinct from the policy owner and the person who reviews outputs. You must enter an approval role before labeling the draft Approved.

Example: An authorized manager or institutional lead reviews a proposed AI use before granting an exception.

The reviewer checks AI-assisted outputs before they are relied on, submitted, or released. Choose a role that can assess accuracy, sources, suitability, and relevant risks. The policy owner reviews the policy itself.

Example: A subject-matter expert verifies an AI-assisted report’s claims and citations before publication.

Name the role or team that receives and coordinates responses to suspected misuse, unsafe outputs, or other policy concerns. Enter a responsibility here, not an email address.

Example: A compliance officer receives reports and involves the security or academic team when needed.

Provide a monitored channel for questions and reports of suspected misuse. Enter an address, internal help route, or other contact method the organization maintains.

Example: An internal service-desk queue monitored by the reporting team. Adding a contact does not send reports or create a mailbox.

Draft means the document is still being prepared or reviewed. Select Approved only after your organization’s authorized approval process is complete.

• Changing this label records a status; it does not obtain approval, certify compliance, or make the policy legally effective.

These options add responsibilities, acknowledgment wording, audience-specific safeguards, and document-control details. Select only measures the organization will implement.

• Including a clause records an expectation. The generator does not enforce it, collect signatures, or verify compliance.

This workplace module adds requirements for leadership, objectives, vendor review, and AI governance.

• The module refers to voluntary NIST AI Risk Management Framework guidance. Including it is not an audit, certification, or proof of compliance with a standard.

This option adds a form for users to confirm that they received and understood the policy.

• It does not prove compliance or replace training. The generator includes the form; your organization collects and retains acknowledgments separately.

This school option requires communication with families about how students may use AI, the safeguards that apply, and where to ask questions.

• Family communication is not automatically consent for collecting or processing a child’s information. Review any consent requirements separately.

This school option requires suitable alternatives when students cannot use an AI tool. Consider cost, accessibility, devices, accounts, and learning needs.

Example: Provide an equivalent non-AI activity when a student cannot access an assigned tool. The clause does not itself provide devices, subscriptions, or accommodations.

A version label helps readers and reviewers identify which edition of the policy applies. Update it when you issue a revised document.

Example: Use 1.0 for an initial release and 1.1 for a later revision. This field is a document label, not automatic version history.

The proposed effective date records when the rules are intended to start applying. Confirm it before adoption, allowing time for approval and communication.

• Entering a date does not approve or automatically activate the policy.

Set the next planned review date, consistent with the review frequency. This is when the responsible people should reassess the document, not necessarily when it expires.

• Review earlier if circumstances change. This date does not create a calendar event or send a reminder.

Before adopting the policy, check unresolved decisions, activity permissions, responsibilities, and any text you edited. The generated policy is a draft, not legal advice or external approval.

• Use Save changes to keep an edited section before switching policies.
• Reading, editing, copying, and sharing do not require email. A Word or PDF download requires the download form; marketing consent remains optional.
• Sharing publishes an immutable snapshot of the selected document for anyone with the link. The link expires after 30 days and can be revoked earlier.