Controlled policy
AI governance policy template for SMEs
A useful AI policy describes how the organisation makes and maintains decisions. It should point people to operational records and owners rather than copying broad principles that cannot be evidenced.
Prepared by EU AI Fit editorial team · Published 24 August 2026 · Source review 31 August 2026 · Page updated 26 September 2026
Download the editable AI policy
Adapt complete policy wording for responsibilities, approval, suppliers, data, oversight, training and incidents. Includes document control, an approval record and a fictional worked example.
No email or account required. Adapt the template to your organisation and review it before use. It is a working aid, not an official form or proof of compliance.
Discuss a readiness sprintPurpose, scope and principles
Define which employees, contractors, systems and uses the policy covers; how it relates to privacy, security and procurement; and the principles used when evidence or authority is uncertain.
Roles and decision rights
Name the governing body, accountable system owner, technical owner, privacy and security contributors, procurement responsibilities and the people authorised to approve, pause or retire AI use.
Required operating processes
Set requirements for discovery, inventory, exposure screening, role and classification review, supplier assurance, evidence, human oversight, training, monitoring, incidents and material-change reassessment.
- No operational use without a named owner
- Escalation for prohibited or high-impact signals
- Evidence and approval retention
- Change notification by suppliers and system teams
- Periodic management review
Control the document
Assign an owner, approver, version, effective date, review date and change history. Mark organisation-specific gaps before approval and retain the evidence that the policy is communicated and operating.
AI governance policy working template
Complete these prompts using your organisation's actual decisions. Where an answer is missing, assign an owner to resolve it before approving the policy.
Download editable worksheet (CSV)No email or account required. Includes response, evidence, owner, review and follow-up columns for your team. This is a working aid, not an official form or proof of compliance.
On smaller screens, scroll the table horizontally or download the worksheet.
| Policy section | Complete this statement | Supporting record |
|---|---|---|
| Scope | This policy covers [teams, contractors, systems and uses]. | Inventory and approved-use list |
| Decision rights | [Role] approves use; [role] may pause it; unresolved questions go to [role]. | Approval and escalation record |
| Acceptable use | Staff may use [tools] for [purposes], subject to [data and oversight limits]. | Operating instructions and system briefing |
| Procurement | Before introducing a supplier, [role] reviews [information and evidence]. | Supplier review and outstanding conditions |
| Training | [Roles] receive [learning and system briefings] before [activity]. | Assignments and completion records |
| Incidents and change | Report [events or changes] to [owner] through [channel]. | Incident plan and reassessment history |
| Review and approval | [Owner] reviews this version on [date] and when [trigger] occurs. | Version, approver and communication record |
Recommended next step
Draft the policy from current inventory and governance facts, resolve every marked gap and approve it as a controlled document—not a generic download.
Run the free exposure checkRelated practical guides
Put the guidance into practice