# AI governance policy template

Original draft by AI Gov Library. Version 1.0 — 7 October 2026.
Free to copy and adapt within your organization. Research starting point, not legal advice, certification or a statement of regulatory compliance.
Replace every bracketed field. Obtain the relevant internal reviews before adoption.

## Policy record
Organization: [name]
Policy owner: [role]
Approving authority: [role or body]
Version and effective date: [version / date]
Next review: [date]
Related policies: [security / privacy / procurement / records / other]

## 1. Purpose and scope
[Organization] uses this policy to assign responsibility for AI use and to require documented review before approval. It applies to [staff, contractors and teams] using, buying or developing [defined AI systems and services], including [AI features in existing products]. Exclusions are [list with reasons and an owner].

## 2. Roles and authority
The policy owner maintains this policy and coordinates reviews. Each AI use case has a named service owner. [Review roles] evaluate issues within their responsibilities. [Approving authority] records the permitted scope and conditions. Unresolved matters go to [escalation role or body]. Users report concerns through [channel].

## 3. Intake and review
Before a new pilot, purchase or material change, the service owner records the purpose, intended users, affected people, data, supplier, likely impacts and proposed safeguards. The reviewer records the review route, evidence required and specialist involvement. No pilot or operational deployment starts until [authority] has approved its specific scope and conditions. A pilot approval does not automatically authorize wider deployment.

## 4. Permitted and restricted uses
Approved uses are recorded in [register] with conditions. Staff use only [approved tools and configurations] for [specified data and tasks]. Restricted or prohibited uses are [list decided by the organization]. Exceptions require [approval route], a documented reason, safeguards and an expiry or review date.

## 5. Supplier and data review
Before approval, [roles] review supplier evidence relevant to the use, data access and reuse, retention, dependencies, performance, security, support and exit arrangements. Unknowns are recorded with an owner. Material unresolved concerns are escalated before the buying or deployment decision.

## 6. Human oversight and evaluation
The owner defines representative evaluation tasks, important failure cases and acceptance criteria. [Role] reviews the results. Human review, override and stop arrangements are documented for the approved use. Changes to autonomy or affected users require a new review. Testing and review records are retained according to [records policy].

## 7. Inventory and decision records
[Inventory owner] maintains records of approved systems and pilots: identifier, purpose, owner, supplier or model, data categories, approved scope, decision, conditions, evidence references and next review. Access is limited according to [access policy]. Retention follows [records schedule].

## 8. Monitoring, incidents and change
The owner monitors [defined performance and risk indicators] at [cadence]. Staff report unexpected behavior or suspected incidents through [channel]. [Role] can restrict or pause use and coordinates the relevant incident process. Review is triggered by [material supplier or model changes, changed data or purpose, incidents, renewal and other specified events].

## 9. Training and policy maintenance
[Role] provides task-appropriate guidance and training before use. The policy owner reviews this policy at [cadence] and after relevant organizational or external changes, consulting specialist owners as needed. Revisions are approved by [authority] and communicated to [audience].

## Adoption checklist
- Replace all bracketed fields and resolve exclusions.
- Confirm owners, authority, exceptions and reporting routes.
- Review against applicable obligations and existing internal policies.
- Test the intake, decision and incident routes with one realistic case.
- Record approval, communicate the policy and schedule review.

## Background sources
NIST AI RMF Playbook: Govern — https://airc.nist.gov/airmf-resources/playbook/govern/
NIST AI RMF Playbook: Manage — https://airc.nist.gov/airmf-resources/playbook/manage/
These provide background on governance and third-party risk. This draft is original editorial work and is not an official NIST template or a clause-by-clause framework mapping.