AI policy checklist

Keep it short enough that people read it. Two to four pages is plenty for most organisations.

Scope and roles

• Which AI the policy covers (tools you buy, AI you build, AI inside other software).
• Who owns AI governance, and who approves new AI uses.
• That every AI system must be in the inventory with an owner.

Allowed and not allowed

• The list of approved tools, and how to ask for a new one.
• Banned uses, including everything prohibited by Article 5.
• Uses that need extra approval because they're high-risk (hiring, credit, health, education, essential services).

Data rules

• What must never go into external AI tools: personal data without a legal basis, customer secrets, source code (if applicable), credentials.
• Whether vendors may train on your data.

Using outputs

• People remain responsible for what they publish or decide with AI help.
• Check facts and sources; AI can be confidently wrong.
• Disclose AI use to customers where required (chatbots, deepfakes, public-interest text).

When things go wrong

• How to report an AI incident or a near miss, and to whom.
• That nobody is blamed for reporting in good faith.

Training and review

• AI literacy training for everyone who uses AI, matched to their role.
• Policy owner and review date (at least yearly, and when the law changes).