Appendix B. Organisational AI Policy Template

Purpose. This policy governs the responsible use of AI systems by employees, contractors, students, and authorised third parties. It aims to enable legitimate benefits while protecting people, information, institutional integrity, and public trust.

1. Scope and definitions

Identify the covered AI tools, users, systems, data categories, and business processes. Define generative AI, AI agent, high-impact use, confidential data, and human review in language staff can understand.

2. Approved and prohibited uses

Maintain an approved-tool register. Prohibit unauthorised processing of restricted information, deceptive impersonation, discriminatory use, evasion of security controls, and unreviewed AI decisions in designated high-impact contexts. List permitted uses and the conditions attached to each.

3. Data protection and security

Classify data before use. Apply data minimisation, access controls, retention limits, secure authentication, supplier review, logging, and incident reporting. Do not enter passwords, secrets, or confidential records into unapproved tools.

4. Verification and disclosure

Users remain responsible for accuracy and appropriateness. Verify claims and references. Disclose material AI use when law, contract, institutional policy, or reasonable expectations require it. Do not present generated material as verified evidence without checking it.

5. High-impact decisions

Require documented assessment, qualified human review, clear responsibility, monitoring, explanation, and appeal routes before AI influences decisions affecting rights, safety, employment, education, health, finance, or essential services.

6. Procurement and supplier management

Assess purpose, model capability, security, privacy, data retention, training use, auditability, accessibility, service continuity, intellectual property, indemnity, incident notification, change management, and exit rights. Do not rely only on vendor marketing.

7. Training, monitoring, and review

Provide role-based training. Maintain an AI system inventory and risk register. Review incidents and complaints. Reassess systems after material changes. Assign an owner and review date to every approved system.

8. Enforcement and exceptions

Provide a confidential route for questions and good-faith incident reporting. Define proportionate consequences for deliberate or repeated violations. Exceptions must be written, time-limited, risk-assessed, and approved by an authorised person.

Policy owner: ____________________ Approval date: ____________________ Review date: ____________________