AI governance
AI policies: what a company needs and what each one covers
A plain guide for the person asked to write the company's rules for AI. It covers what AI policies are, the ones to write first, and how to keep them in use.
AI policies are the written rules for how an organization buys, builds and uses AI: which tools staff may use, what data may go into them, who checks the output, and who answers when something goes wrong. Most companies need a small set, not one long document. Start with an acceptable use policy, a data handling rule, a rule for third-party AI, a human review rule, and a date for reviewing them all.
plain answer
What are AI policies?
AI policies are the written rules for how an organization buys, builds and uses AI. They say which AI tools staff may use, what data may go into them, who must check the output before it is relied on, and who answers when something goes wrong.
NIST's AI Risk Management Framework, a voluntary framework first released on 26 January 2023, lists 'Policies, processes, procedures, and practices across the organization' among the things its Govern function covers. A policy is one document in that wider set of rules. The next section covers which ones most companies need first.
Source: NIST, AI Risk Management Framework (https://www.nist.gov/itl/ai-risk-management-framework) and AI RMF Core (https://airc.nist.gov/airmf-resources/airmf/5-sec-core/), read 6 November 2026.
plain answer
What AI policies does a company need?
A few short policies serve most companies better than one long one. Write these first.
Acceptable use: which AI tools are approved and what staff must not do. Our AI acceptable use policy template has sample wording.
Data handling: which kinds of data may never be entered into an AI tool, and which may be entered only into approved tools.
Third-party AI: how outside AI software and data are checked before use. NIST's Govern function includes 'Policies and procedures are in place to address AI risks and benefits arising from third-party software and data'.
Human review: which outputs a person must check against the source before they are sent or relied on.
Review: NIST says 'Ongoing monitoring and periodic review of the risk management process and its outcomes are planned' and gives no interval, so choose one and write it into each policy.
Source: NIST, AI RMF Core (https://airc.nist.gov/airmf-resources/airmf/5-sec-core/), read 6 November 2026. The quoted lines are NIST's; the policy list is Kriv AI's reading of them, not a NIST list.
plain answer
How do you write AI policies?
Write them in this order. First, list the AI your organization already uses, including tools staff adopted on their own; our guide to managing shadow AI risk covers how to find them. Second, sort the uses by risk, so that drafting a marketing email and summarizing a patient record or a contract do not get the same rule. Third, write each rule in plain words that a new employee can follow without asking. Fourth, name one owner for each policy. Fifth, train the people who must follow it, because a policy nobody has been taught is not in use. Sixth, put a review date on every policy.
A policy that has none of the owner, the training or the review date is the usual reason a written AI policy is ignored.
plain answer
What is the difference between AI policies and an AI governance framework?
A policy says what you believe about AI. A framework says who decides, on what evidence, and where the decision is written down. If an organization has an AI policy but cannot list every AI system it runs, name the owner of each, and show when each was last checked, it has a policy, not a framework. Policies are one input to the framework. The framework adds the inventory, the named owners and the review records that show the policies are being followed. Our AI governance framework page sets out the full set.
Source: Kriv AI, AI governance framework (https://www.kriv.ai/ai-governance-framework), read 6 November 2026. Quoted from our own page.
what kriv does
What Kriv AI does about AI policies
Kriv AI writes AI policies as part of AI governance consulting: the rules, the owners, the inventory and the review steps. It also trains leaders, governance committees, compliance teams and staff to apply them. Both are described on the pages linked here, and both are scoped and priced after a short discovery call.
Kriv AI does not tell you that a policy makes you compliant with a law or standard. Whether a law applies depends on your organization and sector, and a lawyer should answer that.
Sources
Cited sources
- NIST, AI Risk Management Framework (1.0 released 26 January 2023; voluntary use; Generative AI Profile NIST-AI-600-1 released 26 July 2024, not used on the page), read 2026-11-06
- NIST AIRC, AI RMF Core: Govern, Map, Measure, Manage (quoted Govern lines), read 2026-11-06
- Kriv AI, AI governance framework (live page, quoted), read 2026-11-06
- Kriv AI, AI acceptable use policy template (live page), read 2026-11-06
- Kriv AI, AI governance consulting and AI governance training (live pages), read 2026-11-06
Related resources
Continue exploring
Straight answers
Frequently asked questions about AI policies: what a company needs and what each one covers
What is an AI acceptable use policy?
It is the policy that tells employees which AI tools they may use, what data may never go into them, and who must review AI output before it is relied on. It is usually the first AI policy a company writes. Our AI acceptable use policy template has sample wording you can adapt.
How often should AI policies be reviewed?
NIST says ongoing monitoring and periodic review should be planned but gives no fixed interval (read 6 November 2026). Pick an interval that matches how fast your AI use changes, write the review date into each policy and name who does the review.
Who should own AI policies?
Each policy needs one named owner, not a committee. A governance committee can approve the policies, but a single person should answer for keeping each one current.
Does having AI policies make a company compliant?
No. A policy is one input, and the NIST framework is voluntary. Whether a particular law or standard applies to you depends on your organization and sector, so ask your own counsel.
Can Kriv AI write our AI policies?
Yes, as part of AI governance consulting, with training for the people who must follow them. Work is scoped and priced after a short discovery call.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call