The template below is a starting point to adapt. It is not legal advice, and it does not replace advice on the laws that apply to your business and your customers.
We have kept it short on purpose. A policy that people read and follow does more than a long one filed away.
What do NIST and the EU say, in brief?
NIST's AI Risk Management Framework 1.0 (January 2023) is intended to be voluntary, rights-preserving, non-sector-specific and use-case agnostic. It has four functions: govern, map, measure and manage. The govern function covers a culture and structure for managing AI risk, including policies and processes, and its categories include a mechanism to inventory AI systems and processes to decommission and phase out AI systems safely. NIST's framework page says it released a Generative AI Profile (NIST-AI-600-1) on 26 July 2024 and that the framework is being revised.
The European Commission's page on the AI Act says the Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions. It describes four risk levels: unacceptable (banned), high, transparency (for example, telling people they are talking to a machine) and minimal. It gives February 2025 for the first prohibitions and for AI literacy obligations, August 2025 for general-purpose AI rules, August 2026 for transparency rules, and, as set by the AI Omnibus, 2 December 2027 for high-risk systems in sensitive use-case areas (Annex III) and 2 August 2028 for high-risk systems embedded in regulated products (Annex I). Those dates come from Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, published in the Official Journal on 24 July 2026 (EUR-Lex text), whose recitals give 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III and 2 August 2028 for those under Article 6(1) and Annex I. They are now in the published regulation, but the rules have changed before, so check the current text before you rely on a date. Whether the Act applies to you depends on where you place systems on the market and who they affect.
Section 1: Purpose and scope
Sample wording: 'This policy sets how [Company] chooses, uses and reviews artificial intelligence systems, including tools bought from others, services built by us and AI features inside software we already use. It applies to all staff and contractors.' Say what counts as an AI system for your purposes, and include AI features inside everyday software, since staff may not think of them as AI.
Section 2: Roles and accountability
- Executive owner: one senior person accountable for this policy and its review.
- System owner: a named person for each AI system, responsible for its use, results and records.
- Reviewer: a person who checks higher-risk uses before launch. This may be a small group.
- Everyone else: staff must follow the policy and report problems.
Section 3: Inventory of AI systems
Keep a register that lists each AI system, its purpose, owner, vendor, the data it uses, the model or version in use, the date it was approved, the risk level and the date of last review. NIST's govern function includes a mechanism to inventory AI systems, resourced according to risk priorities. Start with a simple sheet and ask each department to list what it uses. You will usually find more than you expected.
Section 4: Risk levels
Sort each use into levels and tie the checks to the level. A simple version, which you can map to the EU Act's categories if it applies to you:
- Not allowed: uses banned by law or by your own rules.
- High: uses that affect people's rights, health, safety, jobs, credit, education or access to essential services. Require review before launch, human oversight and testing.
- Transparency: systems that talk to or generate content for people. Tell people they are dealing with AI, and label generated content where required.
- Low: internal drafting, summarizing and search with no effect on individuals. Allow with basic rules.
Section 5: Data and tools
List which tools are approved and which kinds of data may go into each. Terms differ by provider and plan: for example, OpenAI's data guide for its API (read 12 November 2026) says data sent to the API is not used to train its models by default and that abuse-monitoring logs are kept for up to 30 days. Read each provider's terms for yours. Typical rules: no customer personal data, trade secrets or credentials in an unapproved tool; approved tools only for company work; no uploading of others' confidential material without permission.
Section 6: Human oversight
State where a person must check results: anything that reaches a customer, changes a record that is hard to undo, affects a person's rights or money, or is used for a decision about an individual. Define what 'check' means and how it is recorded. OWASP's prompt injection page (LLM01:2025) lists least privilege and human-in-the-loop controls for privileged operations among its mitigations for language-model applications.
Section 7: Transparency and claims
Tell people when they are dealing with an automated system, do not present AI output as a person's, and make only claims about your AI that you can prove. The FTC said in September 2024 that there is no AI exemption from the laws on the books. If you serve people in the EU, the Commission's page lists transparency rules, such as telling people they are talking to a machine, from August 2026.
Section 8: Vendors and models
Before adopting a tool, ask: where does our data go and how long is it kept, is it used to train models, which model and version runs, how will we be told of changes or retirements, what happens to our data if we leave, and who is liable for errors. Record the answers in the inventory. Revisit them when the vendor changes its terms.
Section 9: Training
Require short training for everyone who uses AI: what it does well, where it fails, what data is allowed, how to check results and how to report a problem. The Commission's AI literacy FAQ says Article 4 has applied since 2 February 2025. As replaced by Regulation (EU) 2026/1744, Article 4 says providers and deployers must take measures to support the development of AI literacy among their staff and others who operate AI systems for them, without requiring any specific level of literacy; the Commission and Member States support these efforts, and the AI Board adopts recommendations. This matters if you place AI systems on the EU market. Keep a record of who completed training.
Section 10: Incidents, review and retirement
- Incidents: how staff report a wrong, harmful or unexpected output, who investigates and when customers are told.
- Review: each system is reviewed at set intervals and when its model, data or use changes.
- Retirement: how a system is switched off safely, what happens to its data and who tells users. NIST includes decommissioning in its govern function.
- Policy review: the policy itself is reviewed at least once a year, and when the law changes.
How do you roll it out?
Start with the inventory, because you cannot govern what you cannot see. Then agree the data rules and the high-risk list with the people who use the tools, publish the policy in plain words, train, and review after three months. Our guide to an AI implementation plan shows where governance sits in the wider work, and our AI consulting page covers help with it.
Conclusion
A useful AI governance policy is short, names owners, lists systems and data rules, ties checks to risk, and is reviewed. NIST's framework and the EU Act give structure, and neither replaces advice on your own obligations.
PromotEdge International is an international strategy, technology, marketing and design company, and our delivery team is in India. This template is not legal advice. See our AI consulting page.
Facts we rely on: see our company facts for what we state about ourselves and where each fact comes from.