---
title: "How to Build an AI Governance Policy in 7 Steps"
description: "Learn how to build an AI governance policy for a 10-500 person company: an owner, an AI inventory, risk tiers, approval paths, training and reviews."
url: https://nexumautomations.com/how-to/build-an-ai-governance-policy
updated: 2026-10-31
publisher: Nexum Automations, an AI consulting firm
---

> Nexum Automations is an AI consulting firm that builds what it recommends. It finds where AI pays off in a company, builds it on the tools the team already uses and stays until it is live and working.

How-to

# How to build an AI governance policy step by step

A seven-step method to write the rules for how your company approves, uses and monitors AI, sized for a team of 10 to 500 people.

Last reviewed October 30, 2026 6 min read

The short answer

To build an AI governance policy, name an owner, list every AI use, sort uses by risk, write rules for each tier, set an approval path for new tools, train people and review on a schedule. Keep it short enough that people read it.

Key points

* Name one owner and a small review group
* Inventory every AI use, approved or not
* Match the rules to the risk of each use
* Give new tools and vendors a clear approval path
* Review on a set date, not when something breaks

Our data

## What buyers see in this search

The first page of Google for "ai governance policy", counted by type of result.

| | Results |
| ---------------------------------------------------- | -------------- |
| Articles by companies that sell a product or service | 7 of 9 |
| Independent publishers and explainers | 1 of 9 |
| Official, academic or standards sources | 1 of 9 |
| Titles that answer this exact search | 4 of 9 |
| Google features on the page | An AI Overview |

The 9 organic results on the first page of Google, United States, desktop, measured with DataForSEO on October 29, 2026\. Types only: no company or product is named.

Step by step

## Seven steps to write the policy

Work through them in order. Each step gives the next one something to build on.

1. ### Name an owner and a review group
Pick one accountable person and two to four colleagues from operations, IT and legal or finance.
2. ### Inventory every AI use
List each tool and task where staff use AI, including free tools nobody formally approved.
3. ### Sort uses by risk
Rank each use by the data it touches and the harm a wrong answer could cause.
4. ### Write the rules for each tier
State what is allowed, what needs review and what is off limits for every level.
5. ### Set the approval path
Define who decides, what they check and how fast for a new tool or vendor.
6. ### Train people and open incident reporting
Show staff the rules in plain words and give them an easy way to report problems.
7. ### Schedule reviews
Put a review date on the policy and assign who updates it.

Side by side

## What buyers see in policies

Elements the ranking guides include, set against the five areas of our AI policy entry and NIST's functions.

| | Seen in the guides read | Covered by the five areas of the AI policy page | NIST AI RMF function |
| ----------------------- | ------------------------------ | ----------------------------------------------- | -------------------- |
| Named owner | Yes, accountable person stated | Yes, owners | Govern |
| AI inventory | Yes, list of uses | Partly, approved tools | Map |
| Risk tiers | Yes, by data and impact | Partly, data rules | Measure |
| Approval path for tools | Yes, vendor and tool review | Yes, approved tools | Manage |
| Output review | Yes, human check | Yes, output review | Manage |
| Review date | Yes, scheduled updates | No, sits outside the five areas | Govern |

## What the policy has to cover

Use rules

* Approved tools
* Data limits
* Output review

Governance rules

* Who approves
* How risk is sorted
* How use is monitored

Guides on the topic define the policy as the rules for how a company approves, uses and monitors AI.

One legal consultancy describes governance as the framework of policies, procedures and controls guiding how AI is deployed and watched over inside an organization.

This page builds the approve-and-monitor layer. The day-to-day use rules, such as approved tools and data limits, sit in our [AI policy](https://nexumautomations.com/glossary/ai-policy) entry. Together they make a complete set.

This is a working method, not legal advice. Check final wording with your own counsel.

## Why a written policy matters now

* Unapproved tools
Staff use AI nobody has reviewed.
* Sensitive uploads
Data lands in public AI tools.
* Costlier breaches
Unsanctioned AI raises incident costs.

Staff are already using AI, with or without permission. In a Cybernews survey of 1,000+ US employees, 59% used AI tools their company had not approved. A WalkMe survey reported 78%.

A University of Melbourne survey from early 2025 reports that 48% of employees uploaded sensitive data to public generative AI tools. Without a policy, nobody has said where the line is.

IBM's 2025 breach report links unsanctioned AI tools to breach costs about $670,000 higher than standard incidents.

## Start with an owner and an inventory

1. Name the owner
One person is accountable.
2. Form the group
Operations, IT, legal or finance.
3. Ask every team
Collect each AI tool and task.
4. Log the data
Note what each tool can see.

One security guide says a policy nobody owns stops getting updated, and a stale one is almost as risky as having none.

Name one person first, then a small group that covers operations, IT and legal or finance.

The inventory comes next. Ask every team what AI they use, including browser tools and built-in assistants.

Expect surprises: reviewing shadow use is the point of this step, and our [shadow AI](https://nexumautomations.com/glossary/shadow-ai) entry explains the pattern.

## Sort uses by risk and write tiered rules

Lower-risk tiers

* Public or non-sensitive data
* Human reviews the output
* Approved tools only

Higher-risk tiers

* Personal or client records
* Decisions about people
* Needs formal sign-off first

Not every use needs the same scrutiny. Drafting a meeting summary from public notes is lower risk than screening job candidates or answering customers from private records.

Use three tiers. For each, write what is allowed, what needs human review and what is off limits.

The NIST AI Risk Management Framework, a voluntary guide, is a useful reference for how to think about managing AI risk.

## Set approval, training and review

1. Request
Staff submit a new tool or vendor.
2. Check
The review group checks data and risk.
3. Decide
Approve, limit or decline, with a reason.
4. Review
Revisit the policy on a fixed date.

Give new tools and vendors one approval path: who decides, what they check and how long it takes. A slow path pushes people back to unapproved tools.

Training matters as much as the text. WalkMe found only 7.5% of employees had received extensive AI training. Add a simple way to report an incident without blame.

Put a review date on the document. One consultancy notes that AI policy written in early 2024 is already out of date, and a policy with no review date stays that way.

## Common mistakes and when to get help

* Borrowed template
Written for a much larger company.
* No owner
Nobody updates it.
* Shelved
Written once, then forgotten.

Copying an enterprise template is the classic error: it assumes resources a mid-size company lacks, so people ignore it.

Another is a policy written once and then not seen again, which one consultancy names as why most fail.

If your uses touch regulated data or your team lacks time, outside help can speed this up. See our [AI governance consulting](https://nexumautomations.com/services/ai-governance-consulting) work, or start with [AI risk management](https://nexumautomations.com/glossary/ai-risk-management) to frame the risks.

FAQ

## Questions about AI governance policies

* ### What is an AI governance policy?
A written set of rules for how a company approves, uses and monitors AI. It names who decides, which uses are allowed, how risk is handled and when the rules get reviewed.
* ### How do you write an AI governance policy?
Name an owner, list every AI use, sort uses by risk, write rules for each tier, set an approval path, train staff and schedule reviews. Keep the wording plain enough that people read it.
* ### How do you create an AI governance policy for a small company?
Skip the enterprise template. Use two or three risk tiers, one owner and a short document. Smaller teams do better with rules they can follow than with exhaustive ones nobody opens.
* ### Is there an AI governance policy template?
Many free templates exist, but they suit larger firms. Use one only as an outline, then cut it to your actual tools, data and teams. The seven steps above give you the sections.
* ### Who should own an AI governance policy?
One named person, backed by a small group from operations, IT and legal or finance. Without a clear owner a policy tends to go stale, which one security guide says is nearly as risky as having none.
* ### How often should the policy be reviewed?
Set a date when you write it and keep to it. AI tools change quickly, so many teams review at least yearly and after any incident or major new tool.
* ### Does the NIST framework apply to my company?
NIST's AI Risk Management Framework is voluntary and open to any organization. It works as a reference for organizing risk work, not as a legal requirement.
* ### Where can I read about the use rules for staff?
Read our [AI policy](https://nexumautomations.com/glossary/ai-policy) entry for approved tools, data rules, output review, disclosure and owners. For outside help building the whole set, see [AI strategy consulting](https://nexumautomations.com/services/ai-strategy-consulting).

---

Source: https://nexumautomations.com/how-to/build-an-ai-governance-policy

Free AI diagnosis (30-minute call): https://nexumautomations.com/#book - Services: https://nexumautomations.com/services - Guides: https://nexumautomations.com/guides