AI policy and governance for organisations

Why you need an AI policy

Staff are already using AI, whether or not there’s an AI policy in place. They summarise documents with a chatbot, have draft emails written, or turn on a meeting tool that takes notes automatically. That’s usually well-intentioned and often useful. The problem is that nobody has a clear view: which tools are running, which customer data goes into them, and who’s accountable if something goes wrong?

An AI policy solves that with a handful of clear agreements. It gives staff clarity on what’s allowed, so they don’t stop out of uncertainty or work around the rules out of convenience. It gives leadership visibility into risk. And it demonstrates that you’ve thought about responsible use, which customers, regulators and auditors increasingly ask about.

There are three concrete reasons to act on this now:

• Shadow use. Without agreements, everyone picks their own tool, often with a personal account you have no control over as an organisation.
• Regulation. Data protection law has applied for years to any processing of personal data, including when an AI tool carries it out. The AI Act adds obligations on top of that, including around AI literacy and transparency, and it reaches UK organisations too once they place an AI system on the EU market or its output is used there.
• Strategy. A policy forces you to choose where AI does and doesn’t belong. That connects directly to your AI strategy: what you want to achieve determines which risks you accept.

An AI policy, then, isn’t a brake. It’s the condition for using AI more widely with confidence.

The parts of an AI policy

A workable policy answers four questions: what can you use, what can go into it, who decides, and how do you keep it safe? Those questions form the backbone of any policy, whether you have twenty staff or two thousand.

Approved tools

Set out which tools are approved and under what conditions. Draw a line between business licences, where you have contractual agreements on data processing, and free consumer versions, where you usually don’t. A short list works better than a long ban: name the tools that are allowed, for what kind of work, and how to request a new one.

Examples of agreements that work well in practice:

• Only use tools under a business account belonging to the organisation.
• Request new tools through a single point of contact, with a decision within an agreed timeframe.
• Tools that automatically record or take minutes of meetings fall under separate agreements.

Data and privacy

For most organisations, this is the most important part. Split data into a few categories, such as public, internal, confidential and personal data, and agree per category what’s allowed in which tool. As soon as personal data is processed, data protection law requires a lawful basis; the ICO sets out the lawful bases in detail. Also record whether there’s a data processing agreement with the vendor and where the data is stored.

If you use AI applications that act autonomously and touch customer or staff data while doing so, the privacy questions get sharper. That situation deserves its own, more detailed treatment elsewhere on this site.

Roles and responsibilities

A policy without an owner is a statement of intent. Name, at minimum:

• An owner of the policy, usually someone from leadership, who approves it and reviews it periodically.
• An owner per application, responsible for its purpose, quality and use.
• A point of contact for questions, requests for new tools, and reports when something goes wrong.
• The role of privacy and information security, such as your data protection officer or security lead, in reviewing new applications.

Also describe what you expect from staff: that they check AI output before using it, and that they stay responsible for the end result.

Risk management

Not every AI application deserves the same level of attention. A tool that drafts an email needs different controls to a system that pre-screens job applicants. So grade applications by risk and tie measures to each level, from simply registering it through to a formal review beforehand, testing, and periodic checks.

Setting up AI governance

Where the AI policy sets out what the agreements are, AI governance is about how you make those agreements work in practice. The biggest risk isn’t regulating too little, but regulating so much that people work around it. My starting point: light wherever possible, heavy only where the risk justifies it.

The most useful approach ties governance to what already exists: add AI to the risk meeting or steering group that’s already in place, rather than setting up a new committee. Four light mechanisms are usually enough at minimum: a register of applications, a single review gate, a periodic check, and a clear escalation path.

If you don’t have the capacity to drive this yourself, a Fractional AI Lead can set up and oversee the governance and cadence; the investment is €2,600 / €5,200 / €10,400 per month.

The AI Act and compliance

The EU AI Act (Regulation (EU) 2024/1689) grades AI systems by risk, with prohibited practices, high-risk systems subject to strict requirements, transparency obligations, and a large group of systems with minimal risk. According to the European Commission, the large majority of AI systems currently used in the EU fall into that last category.

The Act’s reach isn’t limited to organisations established in the EU. Under Article 2 of the Act, it also applies to UK organisations that place an AI system on the EU market, and to UK providers or deployers whose AI system’s output is used in the EU, regardless of where the organisation itself is established. The UK has no AI Act of its own: it regulates AI through existing sector regulators, such as the ICO for data protection and the FCA for financial services, applying shared principles rather than one cross-cutting AI law, as set out in the UK government’s AI regulation: a pro-innovation approach. So a UK-only organisation with no EU market presence and no EU users of its AI output sits outside the Act’s scope, but many UK organisations with EU customers, staff or users of their AI systems are in scope even though they’re not established in the EU.

Two things are already relevant for your AI policy if the Act applies to you (see above):

• AI literacy. Since 2 February 2025, organisations that provide or use AI systems in the EU have had to pay attention to their staff’s AI knowledge. With the Digital Omnibus, which took effect on 27 July 2026, that duty was adjusted: you must take measures to support AI literacy, without a specific level per person being prescribed. According to the Commission, no certificate is required; you can keep an internal record of the training and other initiatives you’ve run. Training in AI literacy is an obvious measure to include in your policy.
• Transparency. If you deploy, for example, a chatbot towards customers, people need to know they’re communicating with AI.

Which obligations apply to your organisation depends on your role and your applications. The Omnibus has also postponed the high-risk rules. How that breaks down by risk category, by role and against the current timeline is a topic for its own page on this site.

This page is a practical explainer, not legal advice. Have the legal classification of your applications reviewed by a lawyer or your data protection officer.

Responsible AI

Responsible AI goes further than what the law asks. It’s about whether you consider an application responsible, even where it’s legally allowed. Think of fairness (does the system treat groups of people equally?), explainability (can you explain to a customer why a decision came out the way it did?), human oversight (who can intervene?), and the impact on staff’s work.

I’d recommend not setting up a separate ethical framework alongside your policy, but including a few principles you actually apply when reviewing new applications. For example: “In decisions that affect people, a staff member always makes the final call.” Or: “We don’t use AI to assess individual staff performance unless leadership explicitly decides to.” Principles you can actually test are worth more than values that sound good.

Responsible AI also touches on adoption. Staff use AI more readily when they understand why the agreements exist and notice that they count for something.

AI policy for small and medium-sized businesses: example and template

A small or medium-sized business doesn’t have a compliance department, and doesn’t need a twenty-page policy either. What it does need is an AI policy that anyone can read in ten minutes, and that answers the questions staff actually have. The steps and outline below are built for that.

Steps

1. Take stock of what’s already in use. Ask teams which AI tools they use and for what. Don’t judge yet; you want an honest picture.
2. Choose the approved tools. Decide which tools you offer officially and which you phase out. Look at functionality, but mainly at the data agreements.
3. Categorise your data. Agree which data should never go into an AI tool, such as customer personal data without a lawful basis, or confidential contracts.
4. Name owners. One owner of the policy, and one point of contact for questions and requests.
5. Write the first version in one to three pages. Use the outline below.
6. Train and communicate. Explain why the agreements exist and how to use AI well; that’s immediately a way of meeting your AI-literacy duty.
7. Review after three months. What’s working, what’s being worked around, which questions keep coming up? Adjust the policy accordingly.

A simple outline to work from

A straightforward structure for your own document:

1. Purpose and scope: why this policy exists and who it covers, including contractors.
2. Approved tools: list of approved tools, accounts and applications, plus the process for requesting a new one.
3. Data: the data categories and what is and isn’t allowed in an AI tool per category.
4. Usage rules: always check output, flag AI use where relevant, and stay personally responsible for the result.
5. Roles: owner of the policy, point of contact, owners of individual applications.
6. Risk and reporting: how new applications get reviewed and where to report an incident or a concern.
7. AI literacy: what training or guidance staff receive and how you keep track of it.
8. Review: when and by whom the policy is evaluated.

Want to know where your organisation stands before you write the policy? The AI Readiness Assessment maps your starting position in 2-3 weeks, including a risk and compliance scan and your position under the AI Act if it applies to you, for €7,000. All amounts and packages are on the pricing page.

I work independently: I don’t sell tools and I don’t receive commissions from vendors, so the policy is built around what fits your organisation. More about my background is on the about page. Where delivery is needed, for example technical set-up, I can suggest parties from my partner network that you contract directly.

Want to talk through a first version of your AI policy? Book a thirty-minute call; by the end you’ll know what I’d sort out first.