AI Compliance Vendors

Free tool · no sign-upAI policy generatorAI acceptable use and AI governance policy templates

Answer a few questions and get a complete, numbered policy you can edit. The library has 29 acceptable-use clauses and 29 governance clauses; 25 of them switch on only when your jurisdictions, data or settings call for them. Each clause has a note explaining which requirement it supports, with the source. Anything only you can decide is left in [brackets].

Clause library and sources checked October 30, 2026. We re-check them at least every 90 days.

Which policy do you want to generate?
1. Organization
2. Where you operate

Adds the clauses each jurisdiction needs. Leave all unticked for a framework-only policy.

3. Regulated data you handle
4. Tools and access

One per line or separated by commas. Leave blank to get placeholders.

May staff use personal AI accounts for work?
Are AI agents allowed (tools that act on a user's behalf)?
5. Risk appetite
6. Ownership

Live preview: AI Acceptable Use Policy

16 sections · 18 clauses · 23 items in [brackets] to fill

[Organization name] AI Acceptable Use Policy

Policy owner
[Policy owner, e.g. Chief Information Security Officer]
Applies to
All staff, contractors and anyone using AI on our behalf
Organization profile
Technology / software, 50–249 people
Jurisdictions considered
None selected
Risk appetite
Balanced
Review cycle
Annually

This template is a starting point, not legal advice. Laws differ by jurisdiction and change often. Have qualified counsel review it before adoption, and fill in or remove every item in [square brackets].

1. Purpose and scope

1.1 Purpose and who this policy covers

This policy sets the rules for using artificial intelligence (AI) tools at [Organization name]. It applies to all employees, contractors, consultants, interns and temporary staff ("staff"), and to anyone else who uses AI tools on [Organization name]'s behalf or with [Organization name]'s data, on any device and in any location.

It covers generative AI chatbots and assistants, AI features built into software we already use, coding assistants, AI agents, browser extensions and any other tool that uses AI to produce content, analysis, recommendations or actions.

This policy works alongside [list related policies, e.g. Information Security Policy, Data Classification Policy, Code of Conduct] and the AI Governance Policy. Where two policies conflict, the stricter rule applies.

2. Definitions

2.1 Key terms
  • AI tool: any software that uses AI to generate content, analyze data, make recommendations or take actions, including AI features inside other software.
  • Approved AI tool: an AI tool listed in the approved AI tools register for the uses and data class stated there.
  • AI agent: an AI tool that can take actions on your behalf, such as sending messages, editing files or records, running code, browsing or making purchases.
  • Personal AI account: an account with an AI provider that you opened yourself rather than one [Organization name] provides.
  • Prompt: anything you give an AI tool, including typed text, uploaded files, images, audio and connected data sources.
  • Output: anything an AI tool produces, including text, code, images, audio, summaries and actions.

3. Approved AI tools

3.1 Use only approved tools

Staff may use only the AI tools listed below, for the uses stated, through accounts provided by [Organization name]:

  • [Tool name]: [approved uses; highest data class allowed]
  • [Tool name]: [approved uses; highest data class allowed]

The current list, with the approved uses and the highest data class allowed for each tool, is kept in the approved AI tools register at [link to register]. The register is maintained by the AI Governance Committee or its delegate in IT.

3.2 Requesting a new AI tool

To use a new AI tool, submit a request through [request channel, e.g. IT service desk form]. The AI Governance Committee or its delegate in IT reviews it for security, privacy, legal and contract terms, including whether the vendor uses our data to train its models and how long it keeps it, before approval.

Do not sign up for, install, connect or pay for an AI tool, including a free trial, before it is approved. Pilots of unapproved tools need written approval and may use Public information only.

3.3 AI features in software we already use

AI features added to software we already use (for example meeting transcription, writing assistants, AI search or "copilot" features) count as new AI tools. Do not switch them on until the AI Governance Committee or its delegate in IT has approved them.

Administrators of approved software check release notes for new AI features and keep them switched off until reviewed. Features that only [e.g. suggest spelling or grammar] are exempt; the register lists the exempt categories.

4. Personal AI accounts

4.1 Personal AI accounts are not allowed for work

Do not use personal AI accounts (free or paid accounts you opened yourself) for [Organization name] work, and do not enter any [Organization name] information into them, including information that seems harmless. Use only accounts provided by [Organization name], which are covered by our contract terms, single sign-on and logging.

If a tool you need is not on the approved list, request it through [request channel].

5. What data you may put into AI tools

5.1 Data classification rules for prompts

Before you enter anything into an AI tool, check its class under [Data Classification Policy]:

  • Public (published or approved for release): may be used in any approved AI tool.
  • Internal (everyday business information not meant for the public): approved AI tools only.
  • Confidential (for example customer data, personal data, contracts, source code, unreleased financial results, strategy): only in tools the register marks as approved for Confidential data, and only the minimum the task needs.
  • Restricted (for example passwords, API keys and other secrets, government ID numbers, payment card numbers, health data, special category personal data): never enter into an AI tool unless the register explicitly allows that tool to handle it.

If you are not sure of the class, treat the information as Confidential. Uploaded files, screenshots, recordings and connected data sources count as prompts.

6. Prohibited uses

6.1 Uses that are never allowed

Do not use AI tools to:

  • make, or materially support, a decision about a person's employment, credit, housing, insurance, healthcare, education or access to essential services, unless that specific use has been approved under the AI Governance Policy;
  • create content that is unlawful, harassing, discriminatory, sexually explicit or deliberately misleading;
  • create realistic images, audio or video of a real person without their consent;
  • impersonate [Organization name], a colleague, a customer or anyone else;
  • get around security controls, monitoring or this policy, including by splitting restricted data across prompts;
  • process information you are not authorized to access;
  • give legal, medical or financial advice to customers unless that use is approved and reviewed by a qualified person.

7. AI agents, browser extensions and connectors

7.1 AI agents are not allowed

Do not use AI agents: tools that take actions on your behalf, such as sending email or messages, changing files or records, running code, making purchases, or browsing and filling in web forms.

Do not install AI browser extensions, plugins or connectors (including Model Context Protocol servers) that give an AI tool access to [Organization name] systems or data. Approved assistants that only read and suggest are not agents for this rule.

To propose an agent use case, submit it through [request channel]. The AI Governance Committee or its delegate in IT decides whether to approve it as a pilot.

8. Reviewing AI output

8.1 You are responsible for what you use

AI output can be wrong, out of date, biased or invented ("hallucinated"), even when it sounds confident. You are responsible for any AI output you use. Before you rely on it or share it:

  • check facts, figures, citations, quotations and legal or technical claims against a reliable source;
  • review and test AI-generated code for security flaws, licensing issues and correctness before merging;
  • check that the content is fair, accurate and appropriate for its audience;
  • have a second person review AI-generated content before it is published or filed with a regulator or court.

9. Intellectual property and confidentiality

9.1 Intellectual property and confidentiality
  • Do not enter third-party material into an AI tool if our agreement with that party forbids it, for example customer data covered by a confidentiality clause or licensed content.
  • Do not ask an AI tool to reproduce copyrighted material, another company's confidential information or a person's likeness or voice.
  • Treat AI output as possibly containing third-party material, and check it before using it in products, marketing or publications.
  • Work you create with AI tools for [Organization name] belongs to [Organization name] under [employment or contractor agreement]. Copyright protection for AI-generated material may be limited, so tell [Legal] before relying on AI output for a core product, brand asset or patent filing.

10. Disclosing AI use

10.1 When to disclose AI use

Be open about AI use with the people who rely on your work:

  • label content sent outside [Organization name] that was mostly generated by AI and not substantially edited by a person;
  • disclose AI use when a client contract, a publisher, a court or a regulator requires it;
  • never let a customer believe they are dealing with a person when they are dealing with an AI system.

11. Training and AI literacy

11.1 Required AI training

All staff complete [AI training course] before they get access to approved AI tools, and refresh it every [12 months]. The training covers how the tools work and fail (including hallucination and bias), the data rules, disclosure, and how to report problems.

People with AI responsibilities (system owners, human-oversight reviewers, developers, procurement staff and AI Governance Committee members) receive additional role-specific training. [HR / Learning and Development] keeps a record of completion.

12. Reporting problems

12.1 What to report and how

Report at once to [security or AI incident channel] if:

  • you entered information into an AI tool that this policy does not allow;
  • an AI tool produced harmful, discriminatory or seriously wrong output that was used or shared;
  • an AI agent took an action you did not intend;
  • you suspect a prompt injection, data leak or compromised account involving an AI tool;
  • you see AI being used in a way that breaks this policy.

[Organization name] does not retaliate against anyone who reports in good faith. Reporting your own mistake promptly counts in your favor.

13. Exceptions

13.1 Asking for an exception

Ask for an exception in writing to the AI Governance Committee or its delegate in IT, giving the business reason, the tool, the data involved, how long you need it (no more than [6 months]) and the safeguards you will use. Approved exceptions are logged, time-limited and reviewed at each policy review. Exceptions are not available for prohibited uses.

14. Enforcement

14.1 Breaches of this policy

Breaking this policy may lead to loss of access to AI tools and to disciplinary action, up to and including dismissal, under [disciplinary policy]; for contractors it may end the engagement. [Organization name] may monitor the use of AI tools on its systems and accounts as permitted by law and described in [monitoring notice].

15. Ownership and review

15.1 Policy owner and review cycle

[Policy owner, e.g. Chief Information Security Officer] owns this policy and reviews it at least once a year, and sooner after a significant change in law, a serious AI incident, or a major change in the AI tools or systems [Organization name] uses. Changes are approved by [approving body, e.g. executive leadership] and communicated to everyone this policy covers.

Version: [1.0] · Approved by: [name and role] · Effective date: [date] · Next review: [date]

16. Acknowledgment

16.1 Staff acknowledgment

I have read and understood the [Organization name] AI Acceptable Use Policy and agree to follow it.

Name: [ ] · Role: [ ] · Signature: [ ] · Date: [ ]

Runs in your browser. Nothing you type is sent or stored.

What a good AI policy contains

A good AI policy is short enough that people read it and specific enough that they can follow it. These are the parts that matter most, whichever template you start from.

  1. 1. A named owner and review date

    Someone accountable, a review cycle, and triggers for an early review such as a new law or a serious incident.

  2. 2. An approved tools list

    Which tools, for which uses, with which data class. Kept in a register so it can change without reissuing the policy.

  3. 3. Data rules for prompts

    Tied to your existing data classes, with clear lines for secrets, personal data and regulated data such as PHI.

  4. 4. A position on personal accounts

    Allowed with Public data only, or banned. Silence is the worst option because staff will decide for themselves.

  5. 5. Embedded AI and agents

    AI features inside software you already use, browser extensions, connectors and agents that act on your behalf.

  6. 6. Clear prohibited uses

    Including decisions about people, which is where most AI laws apply, and any practices your jurisdictions ban outright.

  7. 7. Output review and disclosure

    Who checks AI output, when a second reviewer is needed, and when AI use must be disclosed.

  8. 8. Training, reporting and exceptions

    Training before access, a no-blame reporting route and a written, time-limited exception process.

AI acceptable use policy vs AI governance policy

Most organizations need both. The acceptable use policy tells staff what they may do; the governance policy tells the organization how it decides. Small teams often start with the acceptable use policy and add governance as AI moves into products and decisions about people.

The two documents compared
AspectAI Acceptable Use PolicyAI Governance Policy
AudienceEvery employee and contractorLeadership, risk, legal, security, AI system owners
AnswersWhat may I do with AI at work?How does the organization approve and oversee AI?
Typical length3–6 pages, written for everyone8–15 pages, written for practitioners
Core contentApproved tools, data rules, prohibited uses, output review, disclosure, reportingRoles, inventory, risk tiers, impact assessment, oversight, vendors, monitoring, incidents
Framework anchorNIST AI 600-1 GV-6.1-010 (generative AI acceptable use)ISO/IEC 42001 clause 5.2 and NIST AI RMF GOVERN
Signed by staff?Yes, acknowledged by each personNo, approved by leadership

Sample clauses and why they are there

The full clause library, as used by the generator. Clauses marked with a condition are added only when your answers match it.

AI Acceptable Use Policy (29 clauses)

Purpose and scope · 1 clause

  • Purpose and who this policy covers

    NIST AI 600-1 action GV-6.1-010 asks organizations to update acceptable use policies for generative AI and to cover contractors, consultants and other third-party personnel, not only employees. ISO/IEC 42001 control A.2.3 asks for the AI policy to align with other organizational policies.

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

Definitions · 1 clause

  • Key terms

    Clear definitions stop disputes about whether a meeting-notes feature or a browser extension "counts". NIST AI 600-1 action GV-1.6-002 specifically asks organizations to decide how generative AI embedded in application software is treated.

    Sources: NIST

Approved AI tools · 3 clauses

  • Use only approved tools

    You cannot govern what you have not listed. NIST AI RMF GOVERN 1.6 calls for mechanisms to inventory AI systems, and NIST AI 600-1 action GV-1.6-001 adds generative AI systems to that inventory.

    Sources: NIST; NIST

  • Requesting a new AI tool

    Most unapproved ("shadow") AI is third-party software. NIST AI RMF GOVERN 6.1 asks for policies that address AI risks from third parties, and ISO/IEC 42001 control A.10.3 covers suppliers.

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

  • AI features in software we already use

    Vendors add AI features to existing products all the time, often switched on by default. NIST AI 600-1 action GV-1.6-002 asks organizations to define in policy any inventory exemptions for generative AI embedded in application software; this clause sets that rule.

    Sources: NIST

Personal AI accounts · 2 clauses

  • Personal AI accounts are not allowed for workIf: Personal accounts not allowed, or strict risk appetite

    Consumer accounts sit outside your contracts, so you cannot control training on your data, retention or deletion, and you have no logs. NIST AI RMF GOVERN 6.1 asks for policies covering third-party AI risk. A strict risk appetite always produces this clause.

    Sources: NIST; NIST

  • Limited use of personal AI accountsIf: Personal accounts allowed and risk appetite is balanced or permissive

    Some organizations accept personal accounts for low-risk work to avoid driving use underground. Limiting them to Public information keeps the risk within what consumer terms can bear. NIST AI 600-1 action GV-6.1-010 asks acceptable use policies to address the data used with generative AI.

    Sources: NIST

What data you may put into AI tools · 4 clauses

  • Data classification rules for prompts

    Data leaking through prompts is the most common AI incident inside organizations. Tying AI rules to your existing data classes keeps one rulebook. NIST AI 600-1 action GV-6.1-010 asks acceptable use policies to address data, and AI RMF GOVERN 1.1 asks for legal requirements to be understood and documented.

    Sources: NIST; NIST

  • Protected health information (PHI)If: You handle protected health information

    HHS says a cloud provider that creates, receives, maintains or transmits ePHI for a covered entity or business associate is itself a business associate, and that using one without a HIPAA-compliant BAA violates the HIPAA Rules. On our reading the same applies to an AI vendor that processes PHI.

    Sources: US Department of Health and Human Services

  • Customer financial dataIf: You handle customer financial data

    There is no AI-specific exemption from existing financial privacy and security rules, so this clause applies them to prompts. NIST AI RMF GOVERN 1.1 asks for legal and regulatory requirements involving AI to be understood, managed and documented.

    Sources: NIST; NIST

  • Children's personal dataIf: You handle children's personal data

    Children are a group most privacy laws protect more strongly. The EU AI Act bans AI that exploits vulnerabilities due to age to materially distort behavior in a way that causes significant harm (Article 5(1)(b)), and the GDPR requires an impact assessment before high-risk processing using new technologies (Article 35(1)).

    Sources: EUR-Lex; EUR-Lex

Prohibited uses · 4 clauses

  • Uses that are never allowed

    Clear red lines are the part of an acceptable use policy staff remember. Decisions about people are where most AI laws apply, so this clause routes them to the governance process. NIST AI RMF GOVERN 1.1 asks for legal requirements involving AI to be understood and managed.

    Sources: NIST

  • Practices banned by the EU AI ActIf: European Union selected

    Article 5 prohibitions have applied since February 2, 2025. Regulation (EU) 2026/1744 added bans on AI that generates non-consensual intimate imagery of identifiable people and child sexual abuse material (Article 5(1)(ba) and (bb)), which apply from December 2, 2026. Breaches carry fines of up to €35 million or 7% of worldwide annual turnover (Article 99).

    Sources: EUR-Lex; EUR-Lex (Official Journal of the EU)

  • Practices banned by Texas lawIf: Texas selected

    The Texas Responsible AI Governance Act (HB 149) took effect January 1, 2026. Business & Commerce Code Sections 552.052, 552.056 and 552.057 prohibit these practices; the Texas Attorney General enforces them. Under Section 552.056, disparate impact alone does not show intent to discriminate.

    Sources: Texas Legislature

  • AI in hiring and employee decisionsIf: New York City, California or Colorado selected

    Hiring is the most regulated AI use in the US. NYC Local Law 144 requires a bias audit within one year before use, public audit information and advance notice to candidates. California regulations effective October 1, 2025 apply anti-discrimination law to automated-decision systems and require four years of records. Colorado SB 26-189 covers employment decisions from January 1, 2027.

    Sources: NYC Department of Consumer and Worker Protection; California Civil Rights Department; Morrison Foerster

AI agents, browser extensions and connectors · 2 clauses

  • AI agents are not allowedIf: Agents not allowed

    An agent acts with your access, so a wrong answer or a prompt-injection attack becomes a wrong action. NIST AI RMF GOVERN 3.2 asks for roles and responsibilities to be defined for human-AI configurations and oversight; banning agents until those are defined is a common first step.

    Sources: NIST

  • Rules for AI agentsIf: Agents allowed

    Agents turn AI output into actions, so the controls are about access and approval points. NIST AI RMF GOVERN 3.2 asks for roles and responsibilities to be defined for human-AI configurations and oversight of AI systems. Stricter risk appetites add more approval points.

    Sources: NIST

Reviewing AI output · 1 clause

  • You are responsible for what you use

    The European Commission says staff using generative AI should be told about specific risks such as hallucination. NIST AI RMF GOVERN 4.1 asks for policies that foster a critical-thinking and safety-first mindset.

    Sources: European Commission; NIST

Intellectual property and confidentiality · 1 clause

  • Intellectual property and confidentiality

    NIST AI RMF GOVERN 6.1 asks for policies that address AI risks from third parties, including the risk of infringing a third party's intellectual property or other rights. NIST AI 600-1 action MP-4.1-006 covers how third-party intellectual property will be used, stored and protected.

    Sources: NIST; NIST

Disclosing AI use · 3 clauses

  • When to disclose AI use

    "Accountable and transparent" is one of the seven characteristics of trustworthy AI in the NIST AI RMF, and GOVERN 1.2 asks for those characteristics to be built into policies.

    Sources: NIST

  • EU labeling of deep fakes and public-interest textIf: European Union selected

    These are deployer duties under EU AI Act Article 50(3) and 50(4), which have applied since August 2, 2026. Article 50(4) has exceptions, for example for text that has gone through human review or editorial control, so check with Legal before relying on one.

    Sources: European Commission, AI Act Service Desk

  • Texas: tell patients when AI is used in their careIf: Texas selected and healthcare industry or PHI

    Texas Business & Commerce Code Section 552.051(f), added by HB 149, requires this disclosure from health care providers. It has applied since January 1, 2026.

    Sources: Texas Legislature

Training and AI literacy · 2 clauses

  • Required AI training

    NIST AI RMF GOVERN 2.2 asks that personnel and partners receive AI risk management training. ISO/IEC 42001 clauses 7.2 (Competence) and 7.3 (Awareness) cover the same ground for certification.

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

  • AI literacy (EU AI Act Article 4)If: European Union selected

    Article 4 has applied since February 2, 2025. Regulation (EU) 2026/1744, in force since July 27, 2026, replaced it: providers and deployers must now "take measures to support the development of AI literacy" of their staff, and the duty "does not require providers or deployers to guarantee any specific level of AI literacy of any individual." The European Commission says no certificate is needed and an internal record of training is enough. Deployers of high-risk systems must still give oversight staff the necessary competence and training (Article 26(2)).

    Sources: EUR-Lex (Official Journal of the EU); EUR-Lex; European Commission

Reporting problems · 1 clause

  • What to report and how

    Early reports turn an incident into a near miss. NIST AI RMF GOVERN 4.3 asks for practices that enable incident identification and information sharing, and ISO/IEC 42001 control A.3.3 covers reporting of concerns.

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

Exceptions · 1 clause

  • Asking for an exception

    A workable exception route reduces quiet workarounds. NIST AI RMF GOVERN 1.4 asks for the risk management process to be established through transparent policies, procedures and other controls.

    Sources: NIST

Enforcement · 1 clause

  • Breaches of this policy

    A policy without consequences is guidance. NIST AI RMF GOVERN 1.4 expects policies to be backed by procedures and controls. Check monitoring wording with employment counsel in each country you operate in.

    Sources: NIST

Ownership and review · 1 clause
Acknowledgment · 1 clause

AI Governance Policy (29 clauses)

Purpose, scope and commitments · 2 clauses

  • Purpose and scope

    ISO/IEC 42001 clause 5.2 requires top management to establish an AI policy, and the NIST-hosted crosswalk maps NIST AI RMF GOVERN 1.2 and 2.3 to it.

    Sources: NIST AI Resource Center (crosswalk prepared by Microsoft); NIST

  • Leadership commitments

    NIST AI RMF GOVERN 2.3 asks executive leadership to take responsibility for decisions about AI risks. ISO management-system standards, including ISO/IEC 42001, expect the policy to commit to applicable requirements and continual improvement; check the exact wording of clause 5.2 in the published standard.

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

Principles · 1 clause

  • Trustworthy AI principles

    These are the seven characteristics of trustworthy AI in the NIST AI RMF. GOVERN 1.2 asks for them to be integrated into organizational policies, processes, procedures and practices.

    Sources: NIST

Roles and responsibilities · 1 clause

  • Who does what

    NIST AI RMF GOVERN 2.1 asks for roles, responsibilities and lines of communication to be documented and clear, and GOVERN 2.3 puts responsibility on executive leadership. ISO/IEC 42001 clause 5.3 and control A.3.2 cover AI roles and responsibilities.

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

AI inventory · 1 clause

  • What the AI inventory records

    NIST AI RMF GOVERN 1.6 asks for mechanisms to inventory AI systems, resourced according to risk priorities. NIST AI 600-1 actions GV-1.6-001 and GV-1.6-002 add generative AI and require any exemption for embedded AI to be written into policy. The NIST-hosted crosswalk maps GOVERN 1.6 to the ISO/IEC 42001 resource-documentation controls (A.4).

    Sources: NIST; NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

Risk classification and approval · 1 clause

  • Risk tiers

    NIST AI RMF GOVERN 1.3 asks for processes that set the level of risk management according to the organization's risk tolerance. Tiering lets low-risk use move fast while high-risk use gets full review. ISO/IEC 42001 clause 6.1.2 requires an AI risk assessment process.

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

Impact assessment · 3 clauses

  • AI impact assessment

    ISO/IEC 42001 clause 6.1.4 requires an AI system impact assessment of the potential consequences for individuals, groups and societies; the NIST-hosted crosswalk maps GOVERN 1.5 to its operation in clause 8.4.

    Sources: NIST AI Resource Center (crosswalk prepared by Microsoft)

  • Data protection impact assessment (GDPR)If: European Union selected

    GDPR Article 35(1) requires a DPIA before processing that uses new technologies and is likely to result in a high risk; Article 35(3)(a) names systematic and extensive automated evaluation on which significant decisions are based.

    Sources: EUR-Lex

  • California privacy risk assessmentsIf: California selected

    The CPPA's regulations on ADMT, risk assessments and cybersecurity audits took effect January 1, 2026. Risk-assessment compliance began then, with attestations and summaries due April 1, 2028.

    Sources: California Privacy Protection Agency

Human oversight · 1 clause

  • Human oversight of High-tier systems

    NIST AI RMF GOVERN 3.2 asks for policies that define roles for human-AI configurations and oversight. For high-risk systems in the EU, Article 26(2) requires oversight by people with the necessary competence, training and authority.

    Sources: NIST; EUR-Lex

Decisions about individuals · 5 clauses

  • Solely automated decisions (GDPR)If: European Union selected

    GDPR Article 22(1) gives people the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The Digital Omnibus proposal would change parts of the GDPR, but as of October 30, 2026 it is not adopted.

    Sources: EUR-Lex

  • Solely automated significant decisions (UK GDPR)If: United Kingdom selected

    The Data (Use and Access) Act 2025 inserted UK GDPR Articles 22A-22D; Article 22C lists these four safeguards. The ICO said in March 2026 that it expects employers to monitor for bias, be transparent with candidates and explain how to request human review.

    Sources: legislation.gov.uk; UK Information Commissioner's Office

  • Consequential decisions about Colorado consumersIf: Colorado selected

    Colorado SB 26-189, signed May 14, 2026, repealed and replaced the 2024 Colorado AI Act (SB 24-205) before it took effect. The new law takes effect January 1, 2027. The obligations above follow the Colorado Legislative Council Staff summary; confirm the enrolled text with counsel.

    Sources: Colorado Legislative Council Staff; Morrison Foerster

  • California ADMT requirementsIf: California selected

    The California Privacy Protection Agency says businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027.

    Sources: California Privacy Protection Agency

  • Texas: patient disclosure of AI in health careIf: Texas selected and healthcare industry or PHI

    Texas Business & Commerce Code Section 552.051(f), added by HB 149, requires this disclosure from health care providers. It has applied since January 1, 2026.

    Sources: Texas Legislature

AI in employment decisions · 2 clauses

  • Automated employment decision tools in New York CityIf: New York City selected

    NYC Local Law 144 requires a bias audit within one year of use, public information about the audit and notices to candidates or employees; DCWP materials put the notice at 10 business days before use. DCWP has enforced the law since July 5, 2023.

    Sources: NYC Department of Consumer and Worker Protection

  • Automated-decision systems in California employmentIf: California selected

    California Civil Rights Council regulations, effective October 1, 2025, say an automated-decision system may violate state law if it harms applicants or employees based on protected characteristics, require four years of records including automated-decision data, and warn that some assessments may be unlawful medical inquiries. The testing step is our recommendation, not a quoted requirement.

    Sources: California Civil Rights Department

High-risk AI systems under the EU AI Act · 2 clauses

  • Deployer duties for high-risk AI systemsIf: European Union selected

    These are the deployer obligations in EU AI Act Article 26(1), (2), (5), (6), (7) and (11). Regulation (EU) 2026/1744 set their application dates at December 2, 2027 (Annex III) and August 2, 2028 (Annex I). Breaches can draw fines of up to €15 million or 3% of worldwide annual turnover (Article 99).

    Sources: EUR-Lex; EUR-Lex (Official Journal of the EU)

  • EU transparency duties for deployersIf: European Union selected

    EU AI Act Article 50(3) and 50(4) deployer duties, applicable since August 2, 2026.

    Sources: European Commission, AI Act Service Desk

Third-party AI and procurement · 2 clauses

  • Reviewing AI vendors

    NIST AI RMF GOVERN 6.1 asks for policies on AI risks from third parties, and GOVERN 6.2 for contingency processes for failures in third-party AI systems deemed high-risk. The NIST-hosted crosswalk maps these to ISO/IEC 42001 controls A.10.2 (allocating responsibilities) and A.10.3 (suppliers).

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

  • Business associate agreements for AI vendorsIf: You handle protected health information

    HHS guidance: a cloud provider handling ePHI is a business associate even if it stores only encrypted data without the key, and using it without a BAA violates the HIPAA Rules.

    Sources: US Department of Health and Human Services

Monitoring and decommissioning · 2 clauses

  • Monitoring in production

    NIST AI RMF MEASURE 2.4 asks that the functionality and behavior of the AI system and its components be monitored in production, and GOVERN 1.5 asks for ongoing monitoring of the risk management process.

    Sources: NIST

  • Decommissioning

    NIST AI RMF GOVERN 1.7 asks for processes to decommission and phase out AI systems safely, without increasing risk or decreasing trustworthiness.

    Sources: NIST

Incident management · 1 clause

  • AI incident response

    NIST AI RMF GOVERN 4.3 asks for practices that enable incident identification and information sharing, and MANAGE 4.3 asks that incidents and errors be communicated to relevant AI actors, including affected communities.

    Sources: NIST

Documentation and records · 1 clause

  • What we keep

    Documentation is how you show an auditor or regulator that the rest of the policy happened. NIST AI RMF GOVERN 1.4 asks for the risk management process and its outcomes to be established through transparent policies, procedures and other controls.

    Sources: NIST

Training and AI literacy · 2 clauses

  • Required AI training

    NIST AI RMF GOVERN 2.2 asks that personnel and partners receive AI risk management training. ISO/IEC 42001 clauses 7.2 (Competence) and 7.3 (Awareness) cover the same ground for certification.

    Sources: NIST; NIST AI Resource Center (crosswalk prepared by Microsoft)

  • AI literacy (EU AI Act Article 4)If: European Union selected

    Article 4 has applied since February 2, 2025. Regulation (EU) 2026/1744, in force since July 27, 2026, replaced it: providers and deployers must now "take measures to support the development of AI literacy" of their staff, and the duty "does not require providers or deployers to guarantee any specific level of AI literacy of any individual." The European Commission says no certificate is needed and an internal record of training is enough. Deployers of high-risk systems must still give oversight staff the necessary competence and training (Article 26(2)).

    Sources: EUR-Lex (Official Journal of the EU); EUR-Lex; European Commission

Exceptions and enforcement · 1 clause

  • Exceptions and enforcement

    NIST AI RMF GOVERN 1.4 asks for the risk management process to be backed by transparent policies, procedures and controls; a recorded exception process keeps departures visible.

    Sources: NIST

Policy review and continual improvement · 1 clause

What the rules require now

The requirements the clauses cite, as of October 30, 2026. Several changed in 2026: the EU AI Act was amended by the Digital Omnibus on AI, and Colorado replaced its 2024 AI Act before it took effect. See the state AI law tracker for other US states.

EU AI Act Article 4 (AI literacy)
Applies since February 2, 2025. Since July 27, 2026 it requires providers and deployers to take measures to support the AI literacy of staff and others using AI on their behalf, without guaranteeing any specific level. [1] [4]
EU AI Act Article 26 (deployers of high-risk AI)
Use per instructions, competent human oversight, monitoring and suspension, logs kept at least six months, informing workers and affected people. Applies from December 2, 2027 (Annex III) and August 2, 2028 (Annex I). [2] [1]
EU AI Act Article 50 (transparency)
Deployers disclose deep fakes and AI-generated public-interest text and inform people exposed to emotion recognition or biometric categorization. Applies since August 2, 2026. [3]
GDPR Articles 22 and 35
Limits on solely automated decisions with legal or similarly significant effects, and impact assessments before high-risk processing. Proposed Digital Omnibus changes to the GDPR are not adopted as of October 30, 2026. [8]
UK GDPR Article 22C
Safeguards for significant decisions based solely on automated processing: information, representations, human intervention and the right to contest. [9]
HIPAA
A vendor that creates, receives, maintains or transmits ePHI is a business associate and needs a business associate agreement. [11]
Colorado SB 26-189
Signed May 14, 2026, replacing the 2024 Colorado AI Act before it took effect. Effective January 1, 2027: notice, adverse-outcome explanations, data correction and human review for ADMT in consequential decisions. [12] [13]
NYC Local Law 144
Bias audit within one year before using an automated employment decision tool, public audit information and advance notice. Enforced since July 5, 2023. [14]
Texas HB 149 (TRAIGA)
In effect since January 1, 2026. Bans AI built to incite self-harm, harm or crime, to unlawfully discriminate, or to produce child sexual abuse material; health care providers disclose AI use to patients. [15]
California
CPPA ADMT rules apply to significant decisions from January 1, 2027; risk assessments began January 1, 2026. Civil Rights Council employment regulations on automated-decision systems took effect October 1, 2025. [16] [17]

How to roll out your AI policy

A policy only works if people know it and the tools back it up. Start by finding the AI already in use; our shadow AI guide covers detection, and the AI readiness assessment shows where your program stands.

  1. Find out what is already in use

    Survey teams and check SSO, expense and network logs for AI tools and features. Most organizations find more than they expected.

  2. Set your risk appetite and approved tools

    Decide with Security, Legal and Privacy which tools are approved for which data classes, and whether personal accounts and agents are allowed.

  3. Generate both drafts

    Use the generator for the acceptable use policy and the governance policy, then fill in every [bracketed] item.

  4. Review with the right people

    Legal, Privacy, Security, HR and the business. In the EU, deployers of high-risk systems must inform workers’ representatives before workplace use (Article 26(7)).

  5. Approve, publish and collect acknowledgments

    Have leadership approve it, publish it where staff can find it, and record each person’s acknowledgment.

  6. Train before granting access

    Give AI training before tool access and keep a record. For EU AI Act Article 4, an internal record is enough.

  7. Back it with technical controls

    Single sign-on for approved tools, blocking or warning on unapproved ones, data loss prevention for prompts, and logging.

  8. Review on schedule

    Re-check the approved tools list often and the policy at least on your review cycle, and after any new law or serious incident.

AI policy FAQ

What should an AI policy include?

At minimum: who owns it and when it is reviewed, which AI tools are approved, what data may go into prompts, whether personal accounts and AI agents are allowed, prohibited uses, how output is checked and disclosed, training, how to report problems, and how exceptions work. The generator's library has 29 acceptable-use clauses and 29 governance clauses, and includes only the ones that fit your answers.

What is an AI acceptable use policy?

An AI acceptable use policy (AUP) tells employees and contractors how they may use AI tools at work: which tools, with which data, for which purposes, and what is never allowed. It is short, practical and signed or acknowledged by staff.

What is the difference between an AI acceptable use policy and an AI governance policy?

The acceptable use policy is for everyone and covers day-to-day behavior. The governance policy is for leadership, risk, legal, security and system owners, and covers how the organization approves, classifies, assesses, oversees, monitors and retires AI systems. Most organizations need both; small ones often start with the acceptable use policy.

Is an AI policy legally required?

No US federal law requires a written AI policy. But several rules are hard to meet without one: EU AI Act Article 4 requires providers and deployers to take measures to support AI literacy, high-risk deployers have duties under Article 26, and ISO/IEC 42001 certification requires an AI policy under clause 5.2. Texas HB 149 refers to substantial compliance with NIST’s Generative AI Profile in its defenses (Section 552.105(e)).

Did the EU AI Act’s AI literacy requirement change in 2026?

Yes. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since July 27, 2026, replaced Article 4. Providers and deployers must now “take measures to support the development of AI literacy” of their staff and others using AI on their behalf, and the duty “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The Commission says no certificate is needed and an internal record of training is enough.

Should employees be allowed to use personal ChatGPT or other consumer AI accounts?

It depends on your risk appetite. Consumer accounts sit outside your contracts, so you cannot control training on your data, retention or logging. A common middle ground allows personal accounts for Public information only, with model training switched off. The generator’s strict setting bans them outright.

How should a policy handle AI features inside software we already use?

Treat them as new AI tools: switched off until reviewed, then recorded in the inventory. NIST’s Generative AI Profile (action GV-1.6-002) asks organizations to decide in policy whether any embedded AI is exempt from the inventory, so write that rule down.

Should an AI policy cover AI agents?

Yes. Agents act with the user’s access, so a wrong answer or a prompt-injection attack becomes an action. Either ban them until you have controls, or allow named agents with least-privilege access, human approval before sensitive actions and activity logs.

How often should an AI policy be reviewed?

Review the approved tools list continuously and the policy at least once a year, plus after a significant change in law, a serious AI incident or a major new tool. NIST AI RMF GOVERN 1.5 asks for review to be planned with roles and frequency, and ISO/IEC 42001 control A.2.4 asks for the AI policy to be reviewed at planned intervals.

Do I need extra rules for health data?

If you are a HIPAA covered entity or business associate, yes. HHS says a cloud provider handling ePHI for you is a business associate, even if it only stores encrypted data without the key, and you need a business associate agreement before using it. Choose “Protected health information” in the generator to add those clauses.

Is my information stored when I use this generator?

No. The generator runs entirely in your browser. Nothing you type is sent to us or saved, and there is no sign-up or email gate.

Next steps

Sources

Every source was opened and checked on the date shown. We cite primary texts where they are public. ISO/IEC 42001 is sold by ISO, so clause and control numbers come from the crosswalk hosted by NIST; check the published standard for exact wording.

  1. [1] EUR-Lex (Official Journal of the EU), Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Regulation (EU) 2024/1689 (2026-07-24). Checked October 30, 2026.

    Replaces Article 4 of the AI Act: providers and deployers "shall take measures to support the development of AI literacy" of their staff and others operating or using AI systems on their behalf, and the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual." Sets 2 December 2027 (Annex III) and 2 August 2028 (Annex I) for high-risk rules. Published 24 July 2026.

  2. [2] EUR-Lex, Regulation (EU) 2024/1689 (AI Act), consolidated text as of 27 July 2026 (2026-07-27). Checked October 30, 2026.

    Article 4 as amended; Article 5(1) prohibited practices, including (f) emotion inference in workplaces and education and the new points (ba) on non-consensual intimate imagery of identifiable people and (bb) on child sexual abuse material; Article 26(1), (2), (5), (6), (7) and (11) deployer duties for high-risk systems (instructions for use, human oversight by competent people, monitoring and suspension, logs kept at least six months, informing workers, informing affected people).

  3. [3] European Commission, AI Act Service Desk, Article 50: Transparency obligations for providers and deployers of certain AI systems (2026-07-27). Checked October 30, 2026.

    Article 50(3): deployers of emotion recognition or biometric categorisation systems inform the people exposed. Article 50(4): deployers of systems that generate or manipulate deep fakes disclose that the content is artificially generated or manipulated, and the same applies to AI-generated text published to inform the public on matters of public interest. Based on the consolidated text as at 27 July 2026; only paragraph 7 is marked as amended by the Omnibus.

  4. [4] European Commission, AI literacy: questions and answers. Checked October 30, 2026.

    No certificate is needed; staff using generative AI should be informed about specific risks, for example hallucination; organisations can keep an internal record of trainings and other guiding initiatives; deployers of high-risk systems must still make sure staff are trained for human oversight.

  5. [5] NIST, NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (2023-01). Checked October 30, 2026.

    GOVERN 1.1 (legal requirements understood and documented), 1.2 (trustworthy characteristics in policies), 1.3 (level of risk management set by risk tolerance), 1.4 (transparent policies and controls), 1.5 (planned periodic review with roles and frequency), 1.6 (AI inventory), 1.7 (decommissioning); GOVERN 2.1-2.3 (roles, training, executive responsibility); 3.2 (roles for human-AI configurations and oversight); 4.1 (critical-thinking, safety-first mindset); 4.3 (incident identification and information sharing); 6.1-6.2 (third-party AI risk, including IP, and contingency for high-risk third-party failures); MEASURE 2.4; MANAGE 4.3. The seven trustworthy characteristics.

  6. [6] NIST, NIST AI 600-1, AI RMF: Generative Artificial Intelligence Profile (2024-07). Checked October 30, 2026.

    GV-1.6-001 (add generative AI systems to the AI inventory), GV-1.6-002 (define inventory exemptions for generative AI embedded in application software), GV-6.1-010 (update generative AI acceptable use policies to address proprietary and open-source technologies and data, and contractors, consultants and other third-party personnel), MP-4.1-006 (policies on how third-party intellectual property and training data will be used, stored and protected).

  7. [7] NIST AI Resource Center (crosswalk prepared by Microsoft), NIST AI RMF to ISO/IEC FDIS 42001 AI Management System Crosswalk. Checked October 30, 2026.

    Maps GOVERN 1.2 and 2.3 to ISO/IEC 42001 clause 5.2 "AI Policy" and B.2.2 "AI policy"; GOVERN 1.1 to B.2.4 "Review of the AI policy"; GOVERN 1.6 to B.4.2-B.4.6 (resources); GOVERN 1.5 to 8.4 "AI system impact assessment"; GOVERN 2.1 to 5.3, 7.2 "Competence", 7.3 "Awareness" and B.3.2 "AI roles and responsibilities"; GOVERN 6.1-6.2 to B.10.2 "Allocating responsibilities" and B.10.3 "Suppliers"; GOVERN 1.7 to B.6.2.6. Prepared on the final draft; Annex B guidance numbers mirror the Annex A controls (B.2.2 for A.2.2). Check the published standard for exact wording.

  8. [8] EUR-Lex, Regulation (EU) 2016/679 (GDPR) (2016-05-04). Checked October 30, 2026.

    Article 22(1): the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the person. Article 35(1) and (3)(a): a data protection impact assessment before processing that uses new technologies and is likely to result in a high risk, including systematic and extensive evaluation based on automated processing on which decisions with legal or similarly significant effects are based. The Council agreed its position on proposed GDPR changes in the Digital Omnibus (2025/0360) on 21 October 2026; they are not adopted.

  9. [9] legislation.gov.uk, Data (Use and Access) Act 2025, section 80 (automated decision-making) (2025). Checked October 30, 2026.

    Inserts UK GDPR Articles 22A-22D. Article 22C: where a significant decision is based solely on automated processing, the controller must have safeguards that provide the person with information about the decision, let them make representations, obtain human intervention and contest the decision.

  10. [10] UK Information Commissioner's Office, Automated decisions can streamline the hiring process with the right safeguards in place (2026-03). Checked October 30, 2026.

    The ICO expects employers using automated decision-making in hiring to monitor for bias, tell candidates when it is used and how it works, and tell them how to challenge a decision, including requesting human review.

  11. [11] US Department of Health and Human Services, Guidance on HIPAA and cloud computing. Checked October 30, 2026.

    A cloud service provider that creates, receives, maintains or transmits ePHI for a covered entity or business associate is a business associate, even if it stores only encrypted ePHI without the key; the parties must enter into a HIPAA-compliant business associate agreement, and using the provider without one violates the HIPAA Rules.

  12. [12] Colorado Legislative Council Staff, Summary of Legislation 2026: Information Technology and Artificial Intelligence (2026). Checked October 30, 2026.

    SB 26-189 (automated decision-making technology): deployers give clear and conspicuous notice when consumers interact with an ADMT; after an adverse outcome, give clear instructions and an easy process to request more information about the model and its inputs; respond within 30 calendar days; consumers can ask to correct inaccurate personal data and request meaningful human review of adverse outcomes.

  13. [13] Morrison Foerster, Colorado hits reset on AI regulation (2026-05-15). Checked October 30, 2026.

    Governor Polis signed SB 26-189 on May 14, 2026, repealing and replacing the 2024 Colorado AI Act (SB 24-205), which will not take effect; the new law takes effect January 1, 2027; recommended steps include keeping records for three years.

  14. [14] NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools (AEDT). Checked October 30, 2026.

    Local Law 144 of 2021: an AEDT must have a bias audit within one year of use, information about the audit must be made public, and notices must go to candidates or employees (10 business days before use, per DCWP materials). DCWP has enforced the law and rule since July 5, 2023.

  15. [15] Texas Legislature, H.B. No. 149, enrolled text (Texas Responsible Artificial Intelligence Governance Act) (2025-06-22). Checked October 30, 2026.

    Business & Commerce Code Sec. 552.051(f): a provider of a health care service or treatment that uses AI in relation to it discloses that to the recipient no later than when it is first provided (or as soon as reasonably possible in an emergency). Sec. 552.052 (AI that intentionally aims to incite self-harm, harm to others or crime), 552.056 (intent to unlawfully discriminate; disparate impact alone is not enough), 552.057 (AI developed or distributed with the sole intent of producing child sexual abuse material or unlawful deep fakes, or sexual text conversations imitating a minor). Sec. 552.105(e) refers to substantial compliance with NIST's Generative AI Profile. Took effect January 1, 2026.

  16. [16] California Privacy Protection Agency, California finalizes regulations to strengthen consumers’ privacy (2025-09-23). Checked October 30, 2026.

    Regulations on ADMT, risk assessments and cybersecurity audits took effect January 1, 2026. Businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027; businesses subject to risk-assessment requirements began compliance January 1, 2026, with attestations and summaries due April 1, 2028.

  17. [17] California Civil Rights Department, Civil Rights Council secures approval for regulations to protect against employment discrimination related to artificial intelligence (2025-06-30). Checked October 30, 2026.

    Regulations effective October 1, 2025: an automated-decision system may violate California law if it harms applicants or employees based on protected characteristics; employers maintain employment records, including automated-decision data, for at least four years; some assessments, tests and games may be unlawful medical inquiries.