Questions to Ask When Drafting an AI Policy
A usable AI policy answers concrete questions about people, data and decisions. Work through this checklist with legal, security and the teams who will actually use AI.
Last updated
A policy that only says ‘use AI responsibly’ gives employees no usable boundary. A good policy names approved uses, prohibited data, review requirements, ownership and the response when something goes wrong.
This checklist is a drafting aid, not legal advice. Requirements vary by jurisdiction, industry, customer contracts and the kind of decisions your system affects. Record an owner and review date beside every answer.
Step-by-step guide
Define scope, owners and risk tiers
Which employees, contractors, products and AI systems are covered? Who approves tools, exceptions and policy changes? Classify uses by impact: low-risk drafting, internal analysis, customer-facing output, and high-impact decisions should not share one rule.
- Who is accountable for each deployed system?
- Which uses are prohibited outright?
- When does a pilot become a production system?
Set rules for data and approved tools
List approved tools and configurations. State whether prompts or uploads may contain personal data, credentials, source code, customer records, health data or confidential documents. Define retention, deletion, provider training settings, geographic storage and access controls.
Ask: what data can leave our environment, under which contract, and how will we verify deletion?
Require human review where errors matter
Name the outputs that require qualified human approval before use. Set a higher bar for hiring, credit, insurance, education, healthcare, legal advice, safety and other consequential decisions.
- What evidence must the reviewer check?
- Can a person challenge an AI-assisted decision?
- Who may override the system?
Address accuracy, bias and security
Define pre-release tests, representative evaluation data and minimum performance. Include hallucinations, uneven outcomes across groups, prompt injection, data leakage, insecure generated code and harmful content.
Document known limitations and the conditions under which the system must fail closed or be taken offline.
Clarify disclosure, copyright and records
When must customers or colleagues be told that AI was used? Who checks licenses, trademarks, attribution and rights in training or reference material? Decide which prompts, outputs, approvals, model versions and evaluation results must be retained for audit—and for how long.
Plan monitoring, incidents and review
Give people a clear reporting channel. Define incident severity, containment, notification, evidence preservation and who can suspend a tool. Track model and vendor changes because a system can change without your workflow changing.
Finish with a named policy owner, approval date, next review date, employee training plan and exception register.
Before publishing: confirm the policy has an owner, approved-tool list, data classification rules, prohibited uses, human-review thresholds, disclosure rules, testing requirements, incident process and review date.
Test the draft against three real workflows with the people doing the work. If they cannot tell whether an action is allowed, the policy is not finished.
Related tools and guides
Try the techniques above on AskAI.free - Your first question is free.
Ask AIFAQ
Who should write an AI policy?
A cross-functional group: operational users, security, privacy, legal, HR or compliance where relevant, and an executive owner who can resolve tradeoffs. Legal review alone cannot define a workable process.
Should employees be allowed to use public AI tools?
Only under explicit rules. Define approved tools and configurations, what information may be entered, whether provider training is disabled, and which outputs require review. Confidential or regulated data generally needs a controlled environment and appropriate contract.
How often should an AI policy be reviewed?
Set a regular review at least annually, plus event-driven reviews after a major model or vendor change, new law, security incident, new high-impact use, or material change in the data processed.
What belongs on the prohibited-use list?
Uses that conflict with law, contracts or organizational values; unsupervised high-impact decisions; impersonation or deception; bypassing security; entering prohibited data; and publishing unverified output where errors could cause harm.
Is this checklist legal advice?
No. It is a practical drafting framework. Have qualified counsel assess the laws, regulations, employment rules and contractual obligations that apply to your organization and use cases.