AI governance policy template for SMEs

Purpose, scope and principles

Define which employees, contractors, systems and uses the policy covers; how it relates to privacy, security and procurement; and the principles used when evidence or authority is uncertain.

Roles and decision rights

Name the governing body, accountable system owner, technical owner, privacy and security contributors, procurement responsibilities and the people authorised to approve, pause or retire AI use.

Required operating processes

Set requirements for discovery, inventory, exposure screening, role and classification review, supplier assurance, evidence, human oversight, training, monitoring, incidents and material-change reassessment.

• No operational use without a named owner
• Escalation for prohibited or high-impact signals
• Evidence and approval retention
• Change notification by suppliers and system teams
• Periodic management review

Control the document

Assign an owner, approver, version, effective date, review date and change history. Mark organisation-specific gaps before approval and retain the evidence that the policy is communicated and operating.