Set expectations for workforce use, customer interactions, privacy, security, HR, procurement, and responsible adoption.
Use the template with local leadership, workers, learners, and affected communities. Confirm the rules that apply and name who can answer questions, approve exceptions, and correct harm.
What business problem is being solved and how will value be measured?
Could customer, employee, financial, credential, or proprietary information enter the system?
Could the output affect employment, pricing, credit, eligibility, safety, or customer trust?
Can a qualified person verify and correct the result before harm occurs?
Do the vendor terms, total cost, security, ownership, and exit plan support the business?
These primary and authoritative sources shaped the policy’s rules, review points, and accountability structure.
U.S. Small Business Administration
SBA identifies practical AI uses while emphasizing review, data protection, cybersecurity, intellectual property, transparency, and careful vendor selection.
It shapes the bounded-pilot, human-review, information-protection, workforce, and vendor sections.
Federal Trade Commission
The FTC emphasizes that existing consumer-protection and anti-discrimination law applies to automated systems and unsupported claims remain unlawful.
It supports the truthful-marketing, customer-impact, employment-fairness, evidence, and remedy requirements.
National Institute of Standards and Technology
NIST organizes continuous AI risk work around governance, context mapping, measurement, management, monitoring, incident response, and retirement.
It shapes the inventory, approval roles, risk review, testing, monitoring, incident response, and retirement requirements in this template.
Cybersecurity and Infrastructure Security Agency
CISA advises people not to put sensitive information into AI tools, warns about AI-enabled deception, and emphasizes account security and human expertise.
It supports the input restrictions, security controls, synthetic-media rules, training expectations, and incident reporting steps.
Sources and requirements can change. Check the publication date, read the original material, and confirm the rules that apply locally before making a consequential decision.
Use these policy areas to turn values into decisions, responsibilities, safeguards, and remedies people can understand.
Tell employees which tools and tasks are approved, what information is prohibited, when disclosure is required, and who reviews customer-facing or consequential work.
Keep advertising, reviews, testimonials, pricing, support, and product claims truthful. Clearly identify bots where a person could reasonably believe they are dealing with a human.
Do not use AI to screen, rank, monitor, evaluate, discipline, or terminate workers without qualified review, job-related evidence, bias assessment, notice, and a correction route.
Protect credentials, contracts, trade secrets, financial data, and customer records. Review integrations, model training, subcontractors, incident notice, cost growth, export, and shutdown.
✓ Drafting internal outlines from public or fictional information
✓ Summarizing non-sensitive material for a person to verify
✓ Testing a bounded workflow against time, quality, cost, and error baselines
× Uploading customer, employee, financial, credential, contract, or trade-secret information to unapproved tools
× Automated hiring, firing, pricing, credit, safety, or eligibility decisions
× Publishing invented reviews, testimonials, statistics, citations, or unsupported AI claims
Adapt the clauses and complete the reviews with the people responsible for the work and the people affected by it.
Adapt these clauses for formal review and approval.
Complete before approving a pilot, workflow, purchase, or embedded feature.
Use before signing, renewing, or expanding a service.
Use when information, people, decisions, or trust may have been harmed.
Turn one proposed business workflow into a measurable approval decision and clear employee rule.
Choose one workflow and record the current time, cost, quality, and error baseline.
Map customer, employee, financial, proprietary, and vendor information.
Complete the approval and vendor reviews.
Classify the use and write one allowed and one prohibited example.
Set a 30-day pilot owner, reviewer, measures, disclosure, and stop condition.
Ask a worker and an affected customer what the policy overlooks.
Would the business still stand behind the output if a customer, employee, regulator, or partner asked how it was produced?
Share the plan with the people responsible for the work and the people who may be affected. Confirm local rules, protect private information, and name the person who can answer questions or correct a problem.