A generative AI policy sets the company-wide position on tools like ChatGPT, Claude, Gemini and Copilot: why you use them, who decides, and which principles apply. It sits above the day-to-day acceptable use policy. Use this template as a starting point and adapt it with your legal adviser.
[Company name] generative AI policy
Approved by: [board / leadership team] · Date: [date] · Owner: [name, role]
1. Our position
[Company name] encourages the responsible use of generative AI to improve the quality and speed of our work. We use it to support people, not to replace professional judgement.
2. Principles
- Accountability: a named person is responsible for every AI-assisted output.
- Confidentiality: client and personal data only go into approved tools that do not train on our data.
- Accuracy: AI output is checked by a competent person before use.
- Transparency: we are open with clients and colleagues about material AI use.
- Fairness: AI is not used to make decisions about people without human review.
- Security: AI tools meet our security standards before approval.
- Compliance: we follow applicable law, including privacy law and, where it applies, the EU AI Act.
3. Governance
- The AI owner [role] maintains the approved tools list, the AI risk register and this policy.
- New tools and high-impact uses go through the AI tool approval process.
- Approved tools are reviewed every [quarter].
- Incidents are reported to [email/channel] and reviewed by the AI owner.
4. Training
Everyone who uses AI at work completes AI training when they join and once a year, covering this policy, data rules, checking outputs and reporting problems.
5. Related documents
- AI acceptable use policy
- AI tool approval process
- AI risk register
- Client AI disclosure statement
- Information security and data protection policies
6. Review
This policy is reviewed every 12 months, or sooner if laws, vendors or our use of AI change significantly.