AI Policy: How to Build an Enforceable One in 2026

Key takeaways

• An AI policy is the internal document that sets the rules for how your organization builds, buys, and uses artificial intelligence. It is not a strategy deck, and it is not a page of aspirational principles.
• An AI policy is now a compliance artifact. ISO/IEC 42001 makes one mandatory (Clause 5.2), and the EU AI Act’s AI literacy duty (Article 4) has bound every provider and deployer since February 2025.
• A policy only works when it is wired into an operating model: an inventory of AI systems, controls that enforce the rules, and evidence that proves they were followed.
• Banning tools without offering sanctioned alternatives is the fastest way to create shadow AI. A good policy channels behavior instead of only forbidding it.
• The gap between a policy that passes an audit and one that does not is enforceability: named owners, a review cadence, and a traceable line from each rule to a control.

What an AI policy is (and what it is not)

An AI policy is the governing document that states how an organization is allowed to develop, procure, and use artificial intelligence, and who is accountable when those rules are broken. It converts abstract commitments about responsible AI into instructions that an employee, a contractor, or a procurement officer can actually follow on a Tuesday morning. Three documents are often confused, and keeping them apart is the first step to writing a good one:

• An AI strategy describes what the organization wants to achieve with AI. It is directional and aspirational.
• An AI policy describes the rules that constrain how AI may be used to get there. It is prescriptive and binding.
• AI guidelines or standards describe the detailed how. They sit below the policy and explain, for example, how to classify data before it goes into a model.

A policy that reads like a strategy deck is the most common failure mode. Statements such as “we will use AI ethically” are not rules, because nobody can be found in breach of them. A rule states who may do what, with which systems, using which data, under what oversight, and what happens otherwise. The scope of an AI policy is broader than most first drafts assume. It should cover employees and contractors, AI that the organization builds and AI it merely uses, models embedded in third-party software, and the data that flows into and out of those systems. ISO/IEC 42001, the international management-system standard for AI, treats the AI policy as the top-level statement of intent that the rest of the management system implements. A policy that binds only full-time staff, or only tools the company built itself, leaves the largest exposure uncovered. For the wider picture of how a policy fits alongside other governing artifacts, see our guide to AI governance.

Why an AI policy is now a compliance requirement, not a nice-to-have

For years an AI policy was a matter of good hygiene. That has changed. Three regulatory forces now make a documented, enforced AI policy something an auditor, a regulator, or an enterprise customer can ask you to produce.

The EU AI Act makes literacy and transparency mandatory

The EU AI Act’s Article 4 requires providers and deployers to ensure a sufficient level of AI literacy among staff and anyone operating AI systems on their behalf. This duty has applied since 2 February 2025, and it applies regardless of whether the systems are high-risk or minimal-risk. You cannot demonstrate that your workforce uses AI responsibly if there is no written statement of what responsible use means. The policy is where that statement lives, and it is the natural vehicle for the training that Article 4 expects. Two more articles shape what a policy must say. Article 50 sets transparency obligations, including telling people when they are interacting with an AI system and marking synthetic content. Article 5 lists prohibited practices that no organization may deploy at all. A serious policy hard-blocks the Article 5 practices and encodes the Article 50 disclosures as standing rules rather than case-by-case decisions. The stakes are concrete: penalties under Article 99 reach up to 15 million euros or 3 percent of global annual turnover for most obligations, and up to 35 million euros or 7 percent for the prohibited practices in Article 5, according to Latham and Watkins. Our EU AI Act operator’s guide walks through the obligations in sequence.

ISO/IEC 42001 requires a documented AI policy

If the EU AI Act is the stick, ISO/IEC 42001 is the certification that proves you have a governance system worth trusting. The standard, published in December 2023, is the first certifiable AI management system standard. Its Clause 5.2 requires top management to establish a documented AI policy that fits the organization’s purpose, sets a framework for objectives, and commits to continual improvement. In other words, under 42001 the AI policy is not optional evidence, it is a named requirement an auditor checks. Our explainer on the ISO 42001 AIMS standard covers the wider clause structure.

NIST AI RMF and US state laws raise the floor

In the United States, the NIST AI Risk Management Framework centers its Govern function on aligning policies, procedures, and organizational principles, and NIST’s own crosswalk to ISO 42001 maps that function directly to the standard’s leadership and policy clauses. State law is catching up fast. The Colorado AI Act imposes duties on developers and deployers of high-risk systems used in consequential decisions, and New York City’s bias-audit rules for automated hiring tools already require documented governance. A policy that maps its sections to these regimes travels well across jurisdictions. Our NIST AI RMF guide explains the Govern, Map, Measure, and Manage functions in practice.

What a strong AI policy must contain

Corporate templates converge on a familiar table of contents. What separates a policy that survives an audit from one that does not is whether each section ties to an obligation and to a control. The sections below are the ones a mature AI policy carries, with the obligation each one answers.

• Purpose and scope. State why the policy exists and exactly who and what it binds: staff, contractors, built systems, bought systems, and the data involved.
• Principles. Encode the organization’s values and the legal baseline. Keep them short and testable, and link each to a downstream rule rather than leaving them as slogans. These are the principles our guide to ethical AI turns into practice.
• Permitted and prohibited use. Name the sanctioned tools and the approved use cases, and the ones that are off-limits. This is where Article 5 prohibited practices become hard blocks.
• Data, confidentiality, and intellectual property. Set rules for what data may enter a model, how customer and personal data are handled, and who owns the outputs.
• Human oversight and accountability. Define where a human must stay in or on the loop, and who is accountable for each class of decision.
• Transparency and disclosure. Encode the Article 50 duties: disclose AI interaction, label synthetic media, and document model use where required.
• Procurement and third-party AI. Require that bought models and AI-enabled vendors are assessed before use, so third-party systems inherit the same rules.
• Incident reporting. Give people a defined route to report a harmful output, a data leak, or a misuse, with timelines.
• Roles and responsibilities. Assign a policy owner, an approver, and the accountable executive, ideally as a simple RACI.
• Enforcement. State the consequences of a breach so the policy has teeth.
• Review cadence and versioning. Set a fixed review interval and a version history, because a static AI policy is out of date within a quarter.

A policy that carries these eleven sections and maps each to a regulation and a control is no longer an HR memo. It is the top of a governance system.

From document to enforcement: making the policy auditable

Here is the uncomfortable truth that the ranking corporate guides skip: a policy you cannot enforce is theater. An auditor does not grade the prose. They ask you to prove that the rules were followed, on a named system, on a named date. That proof requires three things the document alone cannot provide. The first is an inventory. You cannot apply a rule to AI systems you cannot see. An AI registry, a living record of every model, use case, dataset, and integration in the organization, is the substrate that makes a policy operable. Without it, “all AI use must be approved” is an unenforceable wish, because nobody knows what AI is in use. This is also why a policy is the primary control against shadow AI: the unsanctioned tools staff adopt quietly are exactly the ones a policy plus an inventory are meant to surface. The second is controls. Each rule in the policy should map to a control that operationalizes it. “Human oversight is required for hiring decisions” becomes a control with an owner, a procedure, and a checkpoint. The policy states the intent; the control makes it happen. The third is evidence. Every control should produce a record: an approval, a log, a completed review. Evidence is what turns a claim into a defensible position when a regulator or an enterprise buyer asks. A platform like AI Sigil exists to close this loop, connecting the policy to an AI registry, to foundational controls, and to the evidence that each control generates. The policy is the entry point; the operating model is what an audit actually inspects.

How to write and roll out an AI policy in 8 steps

You do not need a six-month program to publish a first version. You need a disciplined sequence and a named owner.

1. Map stakeholders. Bring together legal, security, data protection, HR, and the business units that build or buy AI. A policy written by legal alone will be ignored by engineering.
2. Inventory current AI use. Before writing rules, find out what is already in play, including the tools staff adopted without asking. This inventory is the reality your policy has to govern.
3. Set principles and the legal baseline. Anchor the policy to your values and to the regimes that apply to you: the EU AI Act, ISO 42001, NIST AI RMF, and any sector or state law.
4. Draft the sections. Use the eleven-section skeleton above, and write rules, not aspirations. Map each section to an obligation and a control.
5. Define permitted and prohibited use concretely. Name sanctioned tools and approved use cases. Vague bans push people toward shadow AI.
6. Assign owners and a RACI. Every rule needs someone accountable, and the policy needs a single owner who maintains it.
7. Train and communicate. Roll out the policy with the AI literacy training that Article 4 expects, so staff understand not just the rules but the reasoning. Our guide to building an AI governance framework covers how training fits the wider program.
8. Set a review cadence and measure. Fix a review interval, track adoption and incidents, and update the policy as tools and law change.

Common AI policy mistakes

Most weak AI policies fail in the same handful of ways.

• Copy-paste with no inventory. A template adopted without knowing what AI is actually in use governs a fiction.
• Banning tools without alternatives. If the sanctioned path is slower than the shadow path, staff take the shadow path. Provide approved tools, not just prohibitions.
• No named owner. A policy nobody maintains is out of date the moment a new model ships.
• No review cadence. AI capability and regulation both move quarterly. An annual review is already too slow.
• No evidence. A policy with no controls behind it produces nothing an auditor can inspect, which means it fails exactly when it matters.

FAQ

Is an AI policy legally required? It depends on where you operate and what you do, but the direction is one way. ISO/IEC 42001 makes a documented AI policy mandatory for certification, and the EU AI Act’s Article 4 literacy duty, in force since February 2025, effectively requires you to state and teach responsible use. US state laws such as the Colorado AI Act add documented governance duties for higher-risk uses. Even where no single law names the word “policy,” you cannot demonstrate compliance with these regimes without one. What is the difference between an AI policy and an AI governance framework? The policy is the top-level rulebook: what is allowed, who is accountable, what happens on a breach. The framework is the wider operating model that implements it, including the inventory, the controls, the committees, and the evidence. The policy states intent; the framework makes it real. A policy without a framework is unenforceable, and a framework without a policy has no north star. Who should own the AI policy? A single accountable owner, supported by a cross-functional group. In practice the owner often sits in legal, compliance, or a dedicated AI governance function, with input from security, data protection, HR, and engineering. What matters is that one named person maintains the policy and one named executive is accountable for it. How often should an AI policy be reviewed? At least quarterly for fast-moving organizations, and immediately when a major new tool is adopted or a relevant law changes. AI capability and regulation both shift far faster than the annual cycle most corporate policies assume. Build the review interval and a version history into the policy itself. How does an AI policy help with shadow AI? Shadow AI is the ungoverned use of AI tools that IT and governance do not know about. A policy addresses it in two ways: it defines sanctioned tools and approved use cases so staff have a legitimate path, and, paired with an AI inventory, it gives the organization a way to detect and bring unsanctioned use back under control. A ban with no sanctioned alternative makes shadow AI worse, not better. What should an AI policy include to satisfy the EU AI Act? At a minimum: a statement of responsible use and the AI literacy commitment behind Article 4, the transparency and disclosure rules from Article 50, hard prohibitions on the Article 5 practices, and a mapping of AI uses to their risk category so higher-risk systems get the oversight the Act requires. Tie each of these to a control and an owner so the commitments are verifiable rather than declarative.

Conclusion

An AI policy is the smallest artifact that makes AI governance real, and the easiest one to get wrong. Written as a page of principles, it changes nothing. Written as a set of rules, mapped to the EU AI Act, ISO 42001, and NIST AI RMF, and wired into an inventory, controls, and evidence, it becomes the entry point to a governance system an auditor and a customer can trust. Start with the eleven sections, name an owner, set a review cadence, and connect each rule to something that proves it was followed. If you want the policy to do more than sit in a shared drive, build it on an operating model that can enforce it. See how AI Sigil turns a policy into AI governance you can evidence.