AI Governance Policy Generator

# Your organization — AI Governance & Acceptable-Use Policy

> Draft generated from the ShipReady Metrics AI governance policy template. Adapt each
> section to how your teams actually work; a policy that does not match reality is ignored.
> This is a starting outline, not legal advice.

## 1. Purpose & scope

This policy sets out how Your organization adopts and uses artificial intelligence: which tools are
approved, what data may be used with them, who is accountable, and how AI-assisted work is
overseen. It applies to all employees, contractors, and systems that use AI on behalf of Your organization.

## 2. Roles & accountability

AI risk is owned by **_TODO: name the role accountable for AI risk and tool approval_**,
who approves new tools, maintains the AI inventory, and is accountable for AI-related risk across
the organization. Each AI system has a named owner responsible for its appropriate use.

## 3. Approved tools & intake

The following AI tools are approved for use:

- _TODO: list the AI tools approved for use_

To request a new tool, submit it to the policy owner for review before use. Using an unapproved
AI tool for Your organization work is not permitted until it has been through intake.

## 4. Data handling

The following data classes must **never** be entered into AI tools without documented controls
and the policy owner's approval:

- _TODO: list the data classes that must not be entered into AI tools (e.g. PII, secrets, regulated data)_

When in doubt, treat data as restricted and ask before using it with an AI tool.

## 5. Human oversight

A human must review and take responsibility for AI output before it is relied on in the following
cases: _TODO: describe where human review of AI output is required_.
AI assists people; it does not replace accountable human judgment.

## 6. AI inventory (AI-BOM)

Your organization maintains an inventory of AI systems in use — the tool, its purpose, the data it processes,
the model(s) and relevant configuration, and the system owner. New AI systems are recorded before
they go into use. You cannot govern the lifecycle of a system you have not recorded.

## 7. Provenance & records

Enough information is logged to reconstruct an AI-assisted decision after the fact: the system
used, the inputs provided, and the human who reviewed and relied on the output. Records are
retained per Your organization's data-retention schedule.

## 8. Third-party & procurement

Vendors whose products embed AI are subject to diligence proportionate to the risk and the data
involved, including how they use inputs for training and their security posture.

## 9. Prohibited uses

The following uses are never permitted:

- _TODO: list uses that are never permitted (e.g. fully automated high-stakes decisions)_

## 10. Review & exceptions

This policy is reviewed **at least annually** and whenever AI capability or Your organization's usage changes
materially. Exceptions must be requested from the policy owner and are recorded with a rationale
and an expiry.

---

*Aligned to the structure of ISO/IEC 42001 and the NIST AI Risk Management Framework, both of
which assume you can enumerate and manage your AI systems. Sections 6 and 7 (inventory and
provenance) are what make those requirements achievable.*

Nothing is stored or sent anywhere — the policy is generated in your browser. Blank fields become TODO prompts so the draft never invents your rules for you.