A free AI policy template, drafted from your answers in five minutes.
Most organizations are exposed because people are using AI tools with no policy in place, and nobody decided that on purpose. Answer ten questions and watch your acceptable use policy build as you go: 17 sections, including AI agents, vendor AI, and records. The full policy comes as an editable Word document.
Your draft continues with:
A starting draft built from your answers, not legal advice. Have counsel who knows your industry review it before you adopt it.
What a good AI policy covers.
The 17 sections in this template, and why each one is there. Most free templates stop at section nine.
1 to 4. The basics
Purpose, scope, ownership, approved tools. Who the policy covers (contractors and temps too, on any device), who owns it as a role rather than a name, and the short list of tools people may use, on business accounts rather than personal ones. The owner's checklist for approving a new tool is written in, so the list can grow without a meeting.
5 to 7. Data and use
Information that must never be entered, acceptable uses, prohibited uses. The data list is the section people actually read, so it is specific: customer personal information, employee records, credentials, contracts under negotiation, anything marked confidential. Prohibited uses cover the decisions that must stay with a person: hiring, pay, lending, pricing, eligibility.
8 to 10. Accountability
Human review, transparency, regulatory requirements. Who checks AI output before it leaves the organization, when AI use is disclosed, and a clause for the rules your industry already lives under: HIPAA business associate agreements, GLBA, FERPA, or public-records law for government bodies.
11 to 14. The sections most templates skip
Security covers multi-factor sign-in, browser extensions that can read the whole screen, and giving an assistant access to email or files.
AI agents and automation is new in 2026 and matters more every month: an agent that sends email, changes records, or spends money is a different risk from a chatbot that drafts text. The template requires named accounts, least access, a human confirmation step, and logs.
Vendors and third-party AI extends the rules to the software you already pay for, which is where most AI processing of your data actually happens. Four questions to ask before signing and at every renewal.
Records and retention says the quiet part: conversation history in an AI tool is not a records system. Anything that informed a decision of consequence gets saved where you keep everything else.
15 to 17. Making it stick
Reporting a problem, training and acknowledgment, review and enforcement. Same-day reporting with no penalty for self-reporting, an annual read-and-sign, and a yearly review tied to new tools and new law.
How this lines up with NIST AI RMF and ISO 42001
This is an acceptable use policy: the document people sign. It is the first artifact of the Govern function in the NIST AI Risk Management Framework and of the policy requirement in ISO/IEC 42001, not a substitute for either. If a customer, insurer, or regulator asks for an AI governance program, this policy is where it starts, and the AI Readiness Assessment scores the rest: ownership, inventory, shadow AI, data, and security.
Massachusetts and state AI laws
There is no general-purpose state AI statute in Massachusetts as of this writing, but the Attorney General's 2024 advisory made clear that existing consumer protection, anti-discrimination, and data security law (201 CMR 17.00) apply to AI the same as to any other system. Colorado's AI Act and New York City's automated hiring rules reach companies that make decisions about people in those places. The prohibited-uses section is written so the policy holds up under all three.
A policy is the first control, not the last.
What usually comes next, in order.
Business accounts
Move people off personal and free accounts onto ones you manage, with sign-in controls and model training turned off.
Data boundaries
Label what is confidential, and set up the tools so the rules in the policy are enforced, not just written down.
Ownership
Someone who approves tools, keeps the list, and answers when something goes wrong. The policy names the role; the organization has to fill it.
Why does a small organization need an AI policy?
Because people are already using AI tools, usually personal accounts of consumer tools, and often with customer or company information pasted in. Most organizations that are exposed did not decide to be. A short written policy is the cheapest control there is.
Is this legal advice?
No. It is a solid starting draft built from your answers. Have counsel who knows your industry review it before you adopt it, especially in healthcare, finance, education, or government.
What happens to my answers?
The preview is built in your browser. When you unlock the full draft, your answers are sent to us so we can email you the Word version, and they are used for nothing else.
What comes after the policy?
Approving tools, moving people onto business accounts, and deciding who owns AI risk. The AI Readiness Assessment scores where you stand on all of it.
