Guardrails that let your teams use AI with confidence.
Your staff are probably using AI already, sometimes in tools you did not know had it. This starter kit gives you a clear policy, one register of every AI tool and agent, and risk tiers that match review to risk. It draws on our experience running governance in highly regulated environments, scaled to organizations of any size.
Quick governance check
Six questions, about one minute. Your results appear instantly.
What's in the kit
Nine practical components. Three are in the free sample; the complete kit is tailored to your organization in our Governance & Design engagement.
AI Acceptable Use Policy
A plain-language policy covering scope, approved tools, data rules, human review, transparency, prohibited uses, incident reporting, roles and exceptions.
Free sample: Sections 1–4AI Tool & Agent Register
One list of every AI tool, built-in AI feature and agent in use, with its owner, approved uses, allowed data, risk tier, access, vendor data terms and review dates.
Free sample: Full template with example rowsRisk-Tier Quick Reference
Three risk tiers and a clear list of prohibited uses, so low-risk uses move fast and high-risk uses get the right checks.
Free sample: Full referenceOne-Page Staff Quick Guide
The rules most people need day to day on a single page: what to use, what never to enter, when to get a second review, and who to ask.
Full kitHuman Review & Approval Standard
Who reviews what, how review is recorded, and when an AI-assisted output needs a second approver.
Full kitAI Incident Reporting Procedure
How to report and triage AI errors, misuse and data exposure, with corrective action and lessons learned.
Full kitVendor AI Due-Diligence Checklist
Questions to ask before approving an AI tool or AI feature: data use, retention, training on your data, data location, security, access and contract terms.
Full kitStaff Briefing & Acknowledgment
A short briefing deck and acknowledgment form so every person knows the rules and confirms they have read them.
Full kitAI Governance Charter
Roles, decision rights, approval gates and a review cadence for overseeing AI as use grows, including AI agents.
Full kitPreview: AI Acceptable Use Policy
Section 1 is shown. Sections 2–4 are in the free sample; sections 5–9 are in the full kit.
1. Purpose
This policy explains how [Organization] staff may use artificial intelligence (AI) tools, so that we gain the benefits of AI while protecting our clients, our people and our organization.
It applies alongside our existing policies on information security, confidentiality, privacy and acceptable use of technology. Where they overlap, the stricter rule applies.
You remain responsible for any work you produce or send with the help of AI.
2. ScopeIn the free sample
3. Approved toolsIn the free sample
4. Data rulesIn the free sample
5. Human review and accountabilityFull kit
6. TransparencyFull kit
7. Prohibited usesFull kit
8. Reporting incidentsFull kit
9. Roles, exceptions and reviewFull kit
Preview: AI Tool & Agent Register
Every column and two example rows are shown. The free sample includes all example rows and a definition for each field.
| Name | Type | Vendor / platform | Business owner | Approved uses | Allowed data | Risk tier | Human review | Access & permissions | Vendor data terms | Status | Next review |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Enterprise chat assistant | Chat assistant | [Vendor], organizational accounts | Operations Director | Internal drafting, summarizing, research on public information | Amber | 1 | User reviews before use | All staff; no connections to email or files | Training off; history kept [Retention Period]; [Region]; checked [Date] | Approved | [Date + 6 months] |
| Meeting summary feature | Built-in AI feature | [Meeting Platform] | IT Manager | Notes and action items for internal meetings; attendees told when it is on | Amber; no client, HR or personnel meetings | 2 | Organizer reviews before sharing beyond attendees | Meeting organizers only | Training off; transcripts kept [Retention Period]; [Region]; checked [Date] | Pilot | [Date + 3 months] |
Preview: Risk-Tier Quick Reference
Tier names and examples are shown. Data, review and approval requirements for each tier are in the free sample.
Tier 1 · Low
Drafting internal emails, summarizing public articles, brainstorming, formatting documents.
Tier 2 · Moderate
Client-facing drafts, content published under the organization's name, internal reports that inform decisions, meeting summaries shared beyond attendees.
Tier 3 · High
Anything affecting a person's employment, eligibility, pay or access to services; financial transactions; regulated or audited records; AI agents that change records or take actions in other systems.
Prohibited
Final decisions about people made by AI alone; impersonating a real person; creating deceptive content; bypassing security controls; entering credentials; entering others' confidential material without the right to do so.
Get the free sample
We'll email you a private link to the sample right away. It includes:
- AI Acceptable Use Policy, sections 1–4, ready to adapt
- The full AI Tool & Agent Register template with example rows
- The complete Risk-Tier Quick Reference
Tailored to your organization
In our Governance & Design engagement we adapt all nine components to your tools, data, contracts and risk profile, set up your register, and brief your staff, so your guardrails are in place before AI use grows.
This template is general guidance, not legal advice. Review it with your legal counsel and adapt it to your organization, your contracts and the rules that apply to your work before you adopt it.