AI policy examples
Clauses, not whole templates. The difference between a policy that changes behaviour and one that does not is specificity, so this looks at individual clauses close up.
A good AI policy clause is specific and decidable: it names the tools, the people and the action. The illustrations below are illustrations, not real organisations, and
Everything below is illustrative wording, written to show the shape of a strong clause against a weak one. None of it describes a real organisation, and none of it is a case study or a client. Use it as a pattern, not as copy to paste.
What does a good AI policy look like?
It is specific to your tools and decisions, short enough that people actually read it, and clear about who approves what. Each clause resolves a question rather than restating a principle, so a reader can act on it without asking.
The weak version of almost any clause has the same tell: it sounds reasonable and decides nothing. "Staff should use AI responsibly" is not a rule anyone can follow. The examples below take four clauses that matter and show the difference.
Approved tools
A stronger illustration reads like: "Staff may use the tools on the approved list. Adding a new tool requires sign-off from the named approver, who checks its data handling before it is added." It names the list, the person and the check.
A weak illustration reads like: "Only approved AI tools may be used." It sounds firm but leaves the reader with no list, no approver and no way to get a tool approved, so people either stall or go around it.
Data that never goes into an external tool
A stronger illustration names the data: "Do not enter personal data, client-confidential information or unreleased financial information into any external AI tool. Where a tool is needed for such data, use only one the organisation has approved for it." That reflects the NCSC on the risk of public large language models point that public models can retain and expose what is submitted.
A weak illustration says "be careful what you put into AI tools", which names nothing and stops nothing. The strong clause works because a reader can look at a piece of information and know the answer.
Human review before release
A stronger illustration is specific about who and when: "AI-assisted content that goes to a customer or is published must be reviewed by a competent person before release, and that review is recorded." The the GOV.UK AI Playbook makes human review and logging central for the same reason.
A weak illustration says output "should be checked", with no owner and no record, so nobody is accountable and nothing is auditable when a mistake gets out.
Incident reporting
A stronger illustration gives a route and a trigger: "If an AI tool produces a harmful, wrong or non-compliant output that reached someone, report it to the named contact the same day so it can be assessed and logged." The the NIST Generative AI Profile treats incident handling as part of running generative AI, not an afterthought.
A weak illustration mentions "reporting problems" without saying to whom, by when or what counts as a problem, so incidents go unreported until they are unavoidable.
To turn these patterns into a document, the generator drafts the clauses around your answers, and the policy skeleton gives you the bare headings to fill in yourself.