How to Create an AI Governance Policy: A Practical Guide for Business Leaders
As artificial intelligence spreads through organisations, one of the first governance responses is often:
We need an AI policy.
That is sensible.
Employees need to understand what they can use.
What information they can share.
Which AI tools are approved.
When human review is required.
What happens if something goes wrong.
But creating an AI policy can easily become an exercise in trying to write rules for technology that is changing faster than the policy itself.
A document is created.
Legal reviews it.
Leadership approves it.
Employees receive an email.
Six months later, new AI tools have appeared, AI agents can take actions that were not previously possible, employees have developed new ways of using AI and parts of the policy are already outdated.
The problem is not necessarily that the organisation wrote a poor policy.
It may be that it expected the policy to do too much.
An effective AI governance policy should not attempt to predict every future AI scenario.
It should establish:
what principles apply
what boundaries exist
who has authority
what requires approval
where human judgement remains
how issues are escalated
and
where employees go when they are unsure.
The objective is not to create the longest possible AI policy.
It is to create decision clarity.
What is an AI governance policy?
An AI governance policy is a formal organisational document that establishes the rules, responsibilities and boundaries governing how artificial intelligence can be selected, accessed, used, monitored and controlled.
A good AI policy should help employees answer practical questions such as:
Can I use generative AI for this task?
Which tools can I use?
Can I enter customer information?
Can AI produce customer-facing content?
Do I need to check the output?
Can AI make this decision?
Can an AI agent take this action?
Do I need approval?
Who do I ask if I am unsure?
What do I do if something goes wrong?
If the policy cannot help people answer those questions, it may technically exist without being operationally useful.
For a broader introduction to the organisational system around these rules, read What Is AI Governance? A Practical Guide for Business Leaders.
AI policy and AI governance are not the same thing
This distinction is important.
An AI policy is one component of AI governance.
Governance also includes:
ownership;
decision rights;
risk classification;
approval processes;
human oversight;
technical controls;
monitoring;
incident management;
assurance;
executive oversight.
An organisation can therefore have an AI policy without having effective AI governance.
For example, a policy may say:
High-risk AI requires approval.
But if nobody knows:
what counts as high risk;
who approves it;
what evidence is required;
how long approval takes,
then the policy has created a rule without an operating mechanism.
For more on building the wider system, read AI Governance Framework: What Every Organisation Needs in 2026.
The problem with prohibition-first AI policies
Organisations understandably want to reduce risk.
That can produce policies dominated by:
DO NOT
Do not enter confidential information.
Do not use unapproved tools.
Do not make decisions using AI.
Do not generate customer content.
Do not automate processes.
Some restrictions may be completely appropriate.
But a policy consisting mainly of prohibitions creates two problems.
First, employees still need to get work done.
Second, consumer AI tools are easy to access.
If the organisation explains only what people cannot do without giving them safe routes for what they can do, employees may simply work around the policy.
That can increase shadow AI.
For more on why uncontrolled employee AI use develops, read Shadow AI and AI Governance: The Hidden Risk of Uncontrolled AI Use in Your Business.
A better policy therefore needs two sides:
BOUNDARIES
and
ENABLEMENT.
Tell people where they must stop.
But also tell them where they can move confidently.
The Stratify AI Policy Architecture
I would structure an enterprise AI policy around eight components:
PURPOSE → SCOPE → PRINCIPLES → PERMITTED USE → RESTRICTED USE → DECISION RIGHTS → OVERSIGHT → RESPONSE
Together, they answer:
How can people use AI appropriately inside this organisation?
1. PURPOSE — Why does this policy exist?
Start by explaining what the organisation is trying to achieve.
Not:
“This policy exists to control artificial intelligence.”
Instead:
“This policy establishes how artificial intelligence can be used safely, responsibly and effectively while enabling employees to benefit from approved AI capabilities.”
That matters.
It frames governance as an enabler of responsible adoption, not simply a restriction mechanism.
The purpose should reflect the organisation's:
business strategy;
risk appetite;
values;
regulatory environment;
AI ambition.
2. SCOPE — What does the policy cover?
Define what is included.
For example:
generative AI;
embedded AI features;
machine-learning systems;
AI assistants;
AI agents;
third-party AI services;
employee-created AI workflows;
automated decision systems.
Also define who it applies to:
employees;
contractors;
suppliers;
partners;
third parties acting on behalf of the organisation.
One common mistake is writing a policy specifically around a current tool.
For example:
“ChatGPT Policy.”
But technology changes.
The policy should generally govern AI use, while supporting standards can address specific platforms.
That makes the policy more durable.
3. PRINCIPLES — What should guide AI use?
Policies need rules.
But principles help employees make decisions when the exact scenario was not anticipated.
Useful principles might include:
BUSINESS PURPOSE
AI should be used for legitimate organisational purposes.
HUMAN ACCOUNTABILITY
People remain accountable for how AI is used.
PROPORTIONALITY
Controls should reflect potential consequence.
DATA RESPONSIBILITY
Information should only be used where appropriate and authorised.
TRANSPARENCY
Material AI use should be sufficiently visible to the organisation.
HUMAN JUDGEMENT
AI should not replace required human judgement simply because automation is possible.
VALUE
AI should ultimately support meaningful business outcomes.
Principles provide a decision foundation when detailed rules cannot cover every situation.
4. PERMITTED USE — What can employees do?
This is one of the most important sections.
Employees should not need approval for every low-risk AI interaction.
The policy should establish safe zones.
For example, employees might be allowed to use approved AI tools for:
brainstorming;
summarising non-sensitive information;
drafting internal content;
reformatting text;
research using public information;
creating first drafts;
routine productivity support.
Subject to organisational requirements.
The objective is:
If you're inside these boundaries, you can proceed.
That reduces unnecessary approval and encourages responsible experimentation.
Approved tools should be easy to identify
Employees need a simple answer to:
Which AI can I use?
The organisation may maintain:
an approved AI tool list;
approved enterprise platforms;
permitted embedded AI functionality;
approved agent capabilities.
The policy does not necessarily need to list every product permanently.
It can point to a maintained register.
That prevents the policy itself becoming obsolete whenever technology changes.
5. RESTRICTED USE — Where does approval increase?
Some AI use should require additional review.
Examples may include:
personal data;
confidential information;
employee decisions;
customer eligibility;
financial decisions;
regulated activity;
legal outputs;
safety-related decisions;
material external communications;
autonomous transactions.
The important thing is not to create one enormous prohibited list.
Instead, connect restrictions to risk.
For more on doing this consistently, read AI Risk Classification: How to Classify AI Use Cases by Risk.
A useful policy principle is:
The greater the potential consequence, the stronger the approval and oversight requirements.
Policy should distinguish prohibited from controlled use
These are not the same.
PROHIBITED
The organisation has decided this use should not occur.
CONTROLLED
The use may be appropriate, but only when specified conditions are met.
This distinction matters because overly broad prohibition can prevent valuable AI use.
For example, an organisation may not want employees independently using AI to make employment decisions.
That does not necessarily mean AI can never support an HR process.
It means the use requires appropriate assessment, ownership and controls.
6. DECISION RIGHTS — Who can approve what?
A policy that says:
“Approval is required”
without identifying the approval route is incomplete.
Employees need to know:
Who approves a new AI tool?
Who approves a new use case?
Who approves sensitive data access?
Who approves customer-facing AI?
Who approves higher-risk AI?
Who approves agent permissions?
Who can change those permissions?
Who can stop the AI?
For more on establishing those authorities, read AI Decision Rights: Who Should Be Allowed to Approve, Override or Stop AI?
This is where policy connects directly to the organisation's operating model.
The Stratify Policy Escalation Model
A simple policy can establish different routes:
LOW-RISK USE
Proceed within approved boundaries
MODERATE-RISK USE
Register and review
HIGH-RISK USE
Assess and approve
CRITICAL / AUTONOMOUS USE
Control and assure
So:
ENABLE → REVIEW → APPROVE → ASSURE
This mirrors the risk-based governance model we've already developed.
It gives employees a much clearer answer than:
“Contact Legal before using AI.”
7. OVERSIGHT — Where must humans remain involved?
An AI policy should establish when human review is expected.
Examples might include:
verification of factual outputs;
review of customer-facing material;
approval of consequential decisions;
review of financial actions;
handling exceptions;
supervision of autonomous agents.
But simply writing:
“All AI output must be checked by a human”
may not be realistic.
If every output from a high-volume AI system requires manual review, the organisation may eliminate much of the intended benefit.
Oversight should therefore be proportionate to:
consequence;
reliability;
reversibility;
autonomy.
For more on designing meaningful human intervention, read Human Oversight in AI: When Does AI Need a Human in the Loop?
The policy needs to evolve for AI agents
Traditional AI policies often assume:
human asks → AI responds → human decides.
Agents change that.
AI may increasingly:
choose actions;
access systems;
update records;
communicate;
execute transactions;
trigger workflows.
The policy therefore needs to address AI authority, not just AI output.
For more on the difference, read AI Assistants vs AI Agents: What Business Leaders Need to Know Before Giving AI Autonomy.
And for more on determining how much authority an agent should receive, read How Much Autonomy Should You Give an AI Agent? A Practical Framework for Business Leaders.
8. RESPONSE — What happens when something goes wrong?
Employees need a clear incident route.
Examples might include:
sensitive information entered into an inappropriate tool;
unexpected AI behaviour;
incorrect customer outcomes;
security concerns;
biased or inappropriate outputs;
agent actions outside expected boundaries;
unauthorised AI use.
The policy should explain:
what should be reported;
where it should be reported;
when AI use should stop;
who investigates;
who needs to be informed.
People should not be expected to determine incident severity themselves before reporting something.
Make reporting easy.
The AI Policy Decision Tree
An employee-facing policy should ultimately make decisions simpler.
A useful decision tree could be:
Is the AI tool approved?
NO → Check approval route before use.
YES ↓
Does the use involve sensitive or restricted information?
YES → Follow data/risk review.
NO ↓
Could the AI materially affect a customer, employee, financial or regulated outcome?
YES → Use-case assessment required.
NO ↓
Can the AI take actions independently?
YES → Agent/autonomy assessment required.
NO ↓
Is the activity within an approved low-risk use?
YES → Proceed within policy.
That is much more useful to employees than 30 pages of abstract rules.
AI policies should use layers
One policy should not contain every technical detail.
A better structure can be:
LEVEL 1 — POLICY
Principles, responsibilities and boundaries.
LEVEL 2 — STANDARDS
Specific requirements for data, security, agents, human oversight and approved technology.
LEVEL 3 — PROCEDURES
How to request approval, register use cases, report incidents and escalate concerns.
LEVEL 4 — GUIDANCE
Examples, FAQs, training and practical scenarios.
This gives us another useful model:
POLICY → STANDARDS → PROCEDURES → GUIDANCE
The policy remains relatively stable.
The lower layers can change more frequently as technology evolves.
Who should own the AI policy?
The answer will vary by organisation.
The policy may involve:
Technology;
Risk;
Legal;
Compliance;
Security;
Data;
HR;
business leadership.
But somebody should own it.
A cross-functional group can contribute.
A committee can govern.
But a named function or executive should remain accountable for:
maintenance;
review;
communication;
updates;
implementation.
For more on separating governance responsibility from overall business ownership, read Who Should Own AI Governance? A Practical Model for Boards and Leadership Teams.
How often should an AI policy be reviewed?
An annual review may not be enough during periods of rapid AI change.
The organisation should define event-driven review triggers.
For example:
new AI agent capability;
material regulatory change;
significant incident;
new data usage;
new enterprise platform;
major increase in AI autonomy;
new high-risk use case;
change in organisational strategy.
This gives us a better principle than:
Review every 12 months.
Use:
Review periodically and whenever material change occurs.
The AI Policy Change Test
Ask whether anything has materially changed in:
CAPABILITY
What AI can do.
DATA
What information AI can access.
AUTONOMY
What actions AI can take.
IMPACT
Who or what AI can affect.
SCALE
How widely it is used.
REGULATION
What external requirements apply.
If any of those change significantly, the policy or supporting standards may need review.
Training should explain decisions, not just rules
Employees do not need to memorise the policy.
They need to know how to make appropriate decisions.
Training should use scenarios.
For example:
“Can I paste this customer email into our approved AI assistant?”
“Can I use AI to shortlist CVs?”
“Can an agent automatically send this communication?”
“Can I use a free AI tool if the enterprise tool cannot do what I need?”
Practical scenarios help employees understand how policy applies to their actual work.
Policy compliance is not the same as AI governance maturity
An organisation can achieve:
100% employee policy acknowledgement
and still have weak AI governance.
Why?
Because employees may have read the document while:
ownership remains unclear;
shadow AI continues;
high-risk use cases are invisible;
monitoring is weak;
agents have inappropriate permissions;
incidents are not reported;
value is not measured.
Policy acknowledgement is therefore an input metric.
Leadership should also monitor:
registered use cases;
approval volumes;
exceptions;
incidents;
shadow AI indicators;
training;
human overrides;
policy questions;
agent permissions.
The objective is not to prove everyone clicked:
“I have read the policy.”
It is to understand whether the policy is actually shaping behaviour.
Ten questions to test your AI policy
Ask:
Does the policy clearly explain its purpose?
Does it cover AI assistants, embedded AI and agents?
Can employees easily identify approved tools?
Are permitted low-risk uses clear?
Are restricted and prohibited uses distinguished?
Does risk determine approval requirements?
Are AI decision rights explicit?
Is meaningful human oversight defined?
Is incident reporting simple and clear?
Does the policy have change-triggered review mechanisms?
If employees still need to ask Legal or IT about almost every AI interaction, the policy may not yet be providing enough decision clarity.
The best AI policy makes responsible use easier
An AI policy should protect the organisation.
But protection is not achieved by making AI impossible to use.
If governance is too difficult:
employees work around it;
innovation slows;
shadow AI grows;
central teams become bottlenecks.
The better objective is:
freedom within boundaries.
Employees should understand:
where they can act
where they need approval
where they must stop
and
where they can get help.
That is what makes policy operational.
Because the strongest AI policy is not necessarily the document with the most rules.
It is the one that helps the organisation make better AI decisions consistently.
Frequently Asked Questions About AI Governance Policies
What is an AI governance policy?
An AI governance policy establishes the principles, responsibilities, boundaries and requirements governing how artificial intelligence can be used within an organisation.
Does every organisation need an AI policy?
The appropriate approach depends on the organisation and its AI use, but organisations adopting AI should provide clear guidance about acceptable use, data, responsibility, approvals and escalation.
What should an AI policy include?
An AI policy can cover purpose, scope, principles, permitted and restricted use, approved tools, data requirements, decision rights, human oversight, incident reporting and policy review.
Who should own an AI policy?
Ownership varies, but a named function or executive should remain accountable for maintaining and implementing the policy, supported by relevant Technology, Risk, Legal, Security, Data, HR and business stakeholders.
How often should an AI policy be reviewed?
Review it periodically and when material changes occur in AI capability, data access, autonomy, organisational use, regulation or risk.
Should an AI policy ban unapproved AI tools?
Organisations may restrict unapproved tools where security, privacy, contractual or other risks justify doing so. However, simply banning tools without providing useful approved alternatives can encourage shadow AI. Policies should combine clear restrictions with practical routes for safe AI use.
What is the difference between an AI policy and AI governance?
An AI policy documents organisational rules and expectations. AI governance is the wider system of ownership, decision rights, risk management, controls, human oversight, monitoring, incident response and assurance through which those rules are implemented.
How should an AI policy address AI agents?
Policies should consider not only what information AI can process but also what actions agents can take, which systems they can access, what permissions they receive, where human approval is required and when they must escalate or stop.
How Strong Is Your AI Governance?
An AI policy is an important foundation.
But effective governance also requires clear ownership, proportionate risk management, decision rights, human oversight, monitoring and incident response.
Stratify's Executive AI Governance & Risk Assessment helps leadership teams understand whether those foundations are actually in place.
Assess areas including:
Governance foundations
AI policy
Risk classification
Human oversight
Decision rights
Data, security and access
Monitoring
Incident response
Test Your AI Governance
Because having an AI policy does not automatically mean you have AI governance.
The real test is whether people know how to make the right decision when AI is actually being used.
Comments