Your Company Is Using AI Tools
You Probably Don't Have Policies Governing How
8 ready-to-deploy AI governance policies covering acceptable use, data governance, ethics, risk management, model management, transparency, vendor selection, and incident response. Professional .docx files with bracketed placeholders showing exactly where to insert your company details.
Version 3.0, updated 19 October 2026. Instant download by email after payment. Licensed to one organization, every employee included. Licence terms. 14-day refund, any reason. How refunds work. Download a sample (PDF), the opening pages of one document.
The Shadow AI Problem Most Organizations Haven't Solved
Your employees are already using AI tools. ChatGPT, Copilot, Gemini, Grammarly, and dozens of specialized AI applications are in use across your organization right now - many without IT's knowledge, none covered by formal policies. Shadow AI isn't a future threat. It's the current operating reality.
The risk isn't that employees are using AI. The risk is that they're using it without knowing what data they're allowed to share, which outputs require human review, who owns the IP generated by AI tools, or what happens when an AI tool has a security incident that exposed their work. Without a policy framework, every AI interaction is an undocumented data handling event.
Most organizations respond to this by trying to ban AI tools. That approach fails. Employees find workarounds, productivity gains go unrealized, and you create a culture where people hide their tool usage rather than report problems. A better approach is governance: define what's allowed, what requires approval, and what's prohibited - then give employees the clarity to make good decisions without asking permission for every task.
The 8 documents in this bundle are designed to be deployed as a complete governance framework, not a collection of individual policies. The AUP sets the rules and the four data classes that tell employees which data goes where. The Data Governance Policy covers training data, retention, and cross-border transfers. The Vendor Selection Policy gives IT deal-breaker requirements for approving new tools. The Risk Management Policy scores each AI risk by likelihood and impact. The Transparency Policy says when and how to disclose AI use.
8 Documents. Complete AI Governance.
Every template includes bracketed placeholders for your company details, plus headers, footers, and page numbers.
AI Acceptable Use Policy
9-section policy covering approved, restricted, and prohibited tools, permitted and prohibited uses, data handling rules for four data classes, output verification, new tool requests, and enforcement.
AI Data Governance Policy
Data classification for AI, data minimization, training data governance, retention and deletion, cross-border transfers, and data quality.
AI Ethics Policy
Ethical principles, bias and fairness, human oversight, prohibited AI uses, and an AI impact assessment to run before new deployments.
AI Incident Response Supplement
AI incident categories such as prompt injection, AI-specific detection, an AI vendor breach playbook, and a customer notification template. Extends your existing IR plan.
AI Model Management Policy
Model inventory, version control, change management, evaluation criteria, rollback, deprecation, and retirement.
AI Risk Management Policy
AI risk categories, a likelihood-by-impact scoring method (1 to 5 each), and a risk register template.
AI Transparency & Disclosure Policy
When and how to disclose AI use: chat and voice interfaces, AI-generated content, AI-assisted decisions, privacy policy wording, and regulatory disclosure (EU AI Act, GDPR Article 22, FTC, and TCPA).
AI Vendor Selection Policy
Vendor classification, mandatory (deal-breaker) and preferred requirements, the evaluation process, ongoing monitoring, and exit planning.
Framework Mapping
Each policy mapped to the NIST AI RMF 1.0 categories (Govern, Map, Measure, Manage) and the ISO/IEC 42001 Annex A control groups, and the reverse view from framework expectation to the section that meets it. The answer to a customer questionnaire, in one table.
AI Tool Inventory Workbook
Excel workbook with five sheets the policies refer to: the Tool Registry with tiers and data classes, the Model Inventory, the Risk Register with score formulas, the Disclosures list, and the Vendors register with classes and reassessment dates.
Built for Security & IT Leaders
If your organization uses AI tools and doesn't have formal governance, start here.
CISOs & Security Leaders
Implementing AI governance frameworks that satisfy the board, protect the organization, and don't slow down innovation.
Compliance Teams
Documenting AI controls for auditors, regulators, and enterprise customers who ask about your AI governance posture.
IT Leaders
Managing the sprawl of AI tools across your organization. Shadow AI is already happening - now you need policies to govern it.
8 policies, a NIST AI RMF and ISO 42001 mapping, and the inventory workbook. 10,000+ words. Deploy this week.
- 9-section AI Acceptable Use Policy
- AI Data Governance Policy
- AI Ethics Policy with impact assessment
- AI Incident Response Supplement
- AI Model Management Policy
- AI Risk Management Policy with risk register
- AI Transparency & Disclosure Policy
- AI Vendor Selection Policy
- Bracketed placeholders throughout
- Single organization license
Instant download. Nine Word documents (.docx) and one Excel workbook (.xlsx). Version 3.0, 19 October 2026.
Questions
Are these Word documents?
Yes. Nine .docx files (eight policies and the framework mapping) with headers, footers, page numbers, and bracketed placeholders such as [Organization Name] showing exactly where to insert your company information, plus the AI Tool Inventory as an Excel workbook with the registry, model inventory, risk register, disclosures, and vendors sheets.
Can I use these across my organization?
Single organization license. Multiple team members within your company can use and customize the templates. For consulting use across multiple clients, see the Fractional CISO Engagement Kit.
How long does it take to implement these policies?
The bundle does not include a rollout plan or timeline. Each policy runs 1,000 to 1,500 words with a roles table, decision rules, a procedure, records and retention, exceptions, and enforcement, with bracketed placeholders for owners, dates, and tool lists, so legal review and employee rollout set the pace rather than the drafting. A sensible start is the Acceptable Use Policy and the Data Governance Policy, then the rest.
We already have an acceptable use policy. Do we still need this?
Standard AUPs cover internet use, email, and software installation. They don't address AI-generated content disclosure requirements, AI training data policies, or review of AI agents before they are deployed. If your existing AUP wasn't written after 2023, it almost certainly doesn't cover these. The AI AUP in this bundle can supplement an existing policy or replace the AI-relevant sections entirely.
Does this cover the EU AI Act?
The bundle refers to the EU AI Act in three places: the Ethics Policy's impact assessment asks about regulatory obligations, the Risk Management Policy lists EU AI Act non-compliance as a risk category, and the Transparency Policy covers Article 50 disclosure and transparency by risk class. For a full EU AI Act risk classification and compliance framework, see the GDPR AI Compliance Kit which includes an EU AI Act classification guide alongside GDPR requirements.
David A. Moline, CISSP | CISM
Your AI automation, built by someone who secures DoD systems.
Your Team Is Already Using AI. Govern It.
Shadow AI is happening whether you have policies or not. Get governance in place this week with eight policies, the framework mapping, and the inventory to run them.