A fill-in-the-blank AI acceptable use and governance policy for organizations adopting generative AI — mapped to the NIST AI Risk Management Framework and ISO/IEC 42001. Adapt it in a single 90-minute session with IT, HR, and one business owner.
Building the full program? See our AI governance services.
Ten fill-in-the-blank sections covering purpose, scope, roles, data rules, oversight, incidents, training, and enforcement.
A working table for every AI tool: approved uses, allowed data classification, owner, and review date.
Low, moderate, high, and prohibited AI use cases with the review each tier requires before deployment.
Six questions to ask any AI vendor about training on your data, retention, sub-processors, and certifications.
Week-by-week actions to find shadow AI, set guardrails, turn on controls, and train your team.
Eight checks to see whether you have AI governance or just AI exposure.
Every section lines up with a recognized framework, so the same policy supports a future certification effort instead of being thrown away.
| Policy section | NIST AI RMF | ISO/IEC 42001 |
|---|---|---|
| Purpose, scope, roles | Govern | Clauses 4, 5 · Annex A.2–A.3 |
| Approved tools & data rules | Map | Annex A.4, A.6 |
| Risk tiering | Map / Measure | Clause 6.1 · Annex A.5 |
| Human oversight & disclosure | Manage | Annex A.9 |
| Vendor & third-party AI | Map / Manage | Annex A.10 |
| Incidents & monitoring | Measure / Manage | Clauses 9, 10 · Annex A.8 |