AI GOVERNANCE POLICY — [ORGANIZATION NAME]

1. PURPOSE AND SCOPE
   - Why this policy exists
   - Who it applies to (employees, contractors, vendors)
   - What AI systems are covered
   - Effective date and review cadence

2. DEFINITIONS
   - AI / Machine Learning
   - Generative AI
   - Automated decision-making
   - Personal data / Sensitive data
   - High-risk AI use cases

3. ACCEPTABLE USE
   - Approved AI tools and platforms
   - Permitted use cases by department
   - Prohibited uses (explicit list)
   - Approval process for new AI tools

4. DATA AND PRIVACY
   - Data classification for AI inputs
   - Prohibited data types (PII, PHI, confidential)
   - Data retention and deletion
   - Third-party data sharing restrictions

5. RISK ASSESSMENT
   - Risk classification framework (low/medium/high/critical)
   - Required assessments by risk level
   - Approval chain for high-risk deployments
   - Ongoing monitoring requirements

6. TRANSPARENCY AND DISCLOSURE
   - When to disclose AI use to stakeholders
   - Labeling AI-generated content
   - Customer/client notification requirements
   - Internal documentation standards

7. HUMAN OVERSIGHT
   - Human-in-the-loop requirements
   - Decision review thresholds
   - Escalation procedures
   - Override authority

8. BIAS AND FAIRNESS
   - Bias testing requirements
   - Fairness metrics and thresholds
   - Protected class considerations
   - Remediation procedures

9. SECURITY
   - AI-specific security controls
   - Prompt injection prevention
   - Model access controls
   - Incident response for AI failures

10. COMPLIANCE
    - Applicable regulations (EU AI Act, state laws, industry)
    - Audit requirements
    - Record-keeping obligations
    - Reporting requirements

11. TRAINING AND AWARENESS
    - Required training by role
    - Training frequency
    - Competency assessment

12. ENFORCEMENT
    - Violation reporting
    - Consequences framework
    - Appeal process

13. GOVERNANCE
    - AI governance committee composition
    - Review and update cadence
    - Policy exception process
    - Version control

AI USE CASE RISK ASSESSMENT

Use Case: _____________________
Department: ___________________
Requested By: _________________
Date: ________________________

IMPACT ASSESSMENT:
  [ ] Affects individual rights or opportunities?
  [ ] Involves personal or sensitive data?
  [ ] Makes or influences financial decisions?
  [ ] Affects health, safety, or welfare?
  [ ] Has legal or regulatory implications?
  [ ] Could cause reputational harm?
  [ ] Involves vulnerable populations?

DATA ASSESSMENT:
  [ ] What data types are used as inputs?
  [ ] Is PII/PHI/confidential data involved?
  [ ] Where is data stored and processed?
  [ ] What third parties receive data?
  [ ] Is data retention compliant with policy?

TRANSPARENCY ASSESSMENT:
  [ ] Are affected parties informed of AI use?
  [ ] Is the AI's role in decisions clear?
  [ ] Can decisions be explained?
  [ ] Is there an appeal/override mechanism?

RISK LEVEL: [ ] Low  [ ] Medium  [ ] High  [ ] Critical

REQUIRED APPROVALS:
  [ ] Manager (all levels)
  [ ] AI Governance Committee (medium+)
  [ ] Legal review (high+)
  [ ] Board approval (critical)
  [ ] External audit (critical)

APPROVED USES (with appropriate safeguards):

CONTENT AND COMMUNICATION:
  + Drafting internal communications
  + Summarizing documents and meetings
  + Translating content between languages
  + Brainstorming and ideation
  + Editing and proofreading

RESEARCH AND ANALYSIS:
  + Market research synthesis
  + Data analysis and visualization
  + Literature review assistance
  + Trend identification
  + Competitive analysis

PRODUCTIVITY:
  + Code generation and review
  + Template creation
  + Process documentation
  + FAQ and knowledge base content
  + Scheduling optimization

PROHIBITED USES:

  - Inputting confidential business data into public AI tools
  - Uploading PII, PHI, or financial records to unapproved platforms
  - Using AI for final hiring, firing, or disciplinary decisions
  - Generating content that impersonates real individuals
  - Making autonomous decisions that affect individual rights
  - Bypassing security controls or access restrictions
  - Generating misleading, deceptive, or fraudulent content
  - Using AI to surveil employees without disclosure
  - Submitting AI-generated work as original without disclosure
  - Using AI for any illegal purpose

COMPLIANCE MAPPING:

Regulation: [Name]
Applicable: [ ] Yes  [ ] No  [ ] Partially
Scope: [Which AI uses fall under this regulation]

REQUIREMENT                          | STATUS    | OWNER     | DUE DATE
Risk assessment completed            | [ ]       | [Name]    | [Date]
Transparency notices deployed        | [ ]       | [Name]    | [Date]
Bias audit conducted                 | [ ]       | [Name]    | [Date]
Data protection measures in place    | [ ]       | [Name]    | [Date]
Human oversight mechanism active     | [ ]       | [Name]    | [Date]
Documentation/records maintained     | [ ]       | [Name]    | [Date]
Training completed for staff         | [ ]       | [Name]    | [Date]
Incident response plan updated       | [ ]       | [Name]    | [Date]

BIAS TESTING PROTOCOL:

PRE-DEPLOYMENT:
  1. Define protected characteristics relevant to use case
  2. Prepare representative test datasets
  3. Run model outputs across demographic groups
  4. Calculate disparate impact ratios
  5. Document results and remediation if needed

ONGOING MONITORING:
  Frequency: [Monthly / Quarterly / per regulation]
  Metrics:
    - Demographic parity: Equal selection rates across groups
    - Equalized odds: Equal error rates across groups
    - Calibration: Equal accuracy across groups
  Threshold: Disparate impact ratio < 0.8 triggers review

REMEDIATION:
  1. Identify root cause (data, model, process)
  2. Document corrective action plan
  3. Implement fix and retest
  4. Report to governance committee

AI VENDOR ASSESSMENT:

Vendor: _____________________
Tool/Service: _______________
Assessment Date: _____________

DATA HANDLING:
  [ ] Data processing agreement (DPA) in place?
  [ ] Where is data processed and stored?
  [ ] Is data used to train vendor's models?
  [ ] Can training opt-out be enforced?
  [ ] Data retention and deletion policies?
  [ ] Encryption at rest and in transit?
  [ ] SOC 2 Type II or equivalent certification?

SECURITY:
  [ ] Access controls and authentication?
  [ ] Audit logging available?
  [ ] Incident response procedures?
  [ ] Penetration testing conducted?
  [ ] Vulnerability management program?

COMPLIANCE:
  [ ] GDPR compliance (if applicable)?
  [ ] HIPAA compliance (if applicable)?
  [ ] Sector-specific certifications?
  [ ] Subprocessor transparency?

RECOMMENDATION: [ ] Approve  [ ] Conditional  [ ] Reject

POLICY REVIEW SCHEDULE:

ANNUAL REVIEW (minimum):
  - Full policy review by governance committee
  - Regulatory landscape update
  - Incident review and lessons learned
  - Stakeholder feedback incorporation

TRIGGERED REVIEWS:
  - New regulation enacted affecting AI use
  - Significant AI incident (internal or industry)
  - Major new AI tool adoption
  - Organizational restructure
  - Merger/acquisition
  - Audit finding requiring policy change

VERSION CONTROL:
  Version: [X.X]
  Last Updated: [Date]
  Approved By: [Name/Committee]
  Next Review: [Date]
  Change Log: [Summary of changes per version]