Show the site for
Oh My AIJob helper Beta
Choose a botAsk with

PrivacyNothing you type here is sent to us or saved by us. When you press Go, your question goes to the bot you picked, in a new tab, and that bot’s company handles it under its own privacy policy. Please don’t type personal details.For some bots we also copy your question to your clipboard so you can paste it. How this site handles data

Home · Handbook · Corporate AI policy

Build & rules · AI Policy Handbook

Corporate AI policy

Technology, law, and practice. As of November 3, 2026.

Facts checked November 3, 2026

As of November 3, 2026

How organizations commonly write internal AI rules, assign governance, review vendors, and map duties under laws already summarized in this handbook. Descriptive and vendor-neutral. Snapshot as of Nov 3, 2026. Not legal advice.

In one minute
  • Many organizations start with a written acceptable-use policy, an approved-tools list, and rules for confidential data in prompts.
  • Governance usually names owners (legal, security, HR, IT, risk) and may add an AI committee for higher-risk uses.
  • Vendor contracts commonly address data use, training opt-out, security attestations (for example SOC 2), indemnity, and subprocessors.
  • NIST AI RMF and ISO/IEC 42001 are frequently cited voluntary frameworks for risk assessment and management systems.[25,27]
  • Businesses may face deployer or provider duties under the EU AI Act and state rules on hiring tools, notices, and discrimination (Colorado, NYC Local Law 144, Illinois, Texas TRAIGA, California)—fact-specific; confirm with counsel.[21,1,48]

Writing an internal AI acceptable-use policy

Published corporate policies typically state purpose and scope (employees, contractors, systems), define “AI” for the organization, list permitted and prohibited uses, require human review for external or high-stakes outputs, and point to incident and escalation paths. Policies often cross-reference existing information-security, privacy, records, and code-of-conduct rules rather than replacing them. As of Nov 3, 2026, there is no single U.S. federal statute that mandates a private-sector AI acceptable-use policy; adoption is driven by risk management, customer contracts, and sector or state rules that apply to particular uses.

  • ScopeWhich roles, devices, and environments the policy covers (corporate accounts only vs. any AI used for work).
  • Allowed usesDrafting, summarization, coding assist, research—with named review requirements before customer or public release.
  • Prohibited usesCommonly: autonomous legal, medical, or credit decisions without required human process; covert monitoring where law forbids it; generating deceptive content about the company or individuals.
  • ExceptionsA written path to approve higher-risk pilots with security and legal sign-off.

Employee guidelines

Data entryDo not paste secrets, regulated personal data, non-public financials, or attorney-client material into tools that are not approved for that data class.
Confidential informationTrade secrets, customer lists, unpublished product plans, and credentials stay on approved systems; consumer AI accounts are often barred for work data.
Approved toolsA maintained allow-list (and sometimes a deny-list) tied to contract terms: retention, residency, non-training, logging, and SSO.
AttributionSome policies require labeling AI-assisted drafts internally until a human owns the final version.
VerificationStaff remain responsible for factual accuracy, citations, and compliance of anything they send externally.
TrainingShort, role-based training on approved tools and data classes; Texas DIR-certified training applies to covered public employers, not private firms generally.[2]

AI governance roles and committees

Organizations that document AI governance often assign an executive owner, a cross-functional working group, and clear RACI for legal, privacy, security, HR, procurement, and business units. Higher-risk uses (hiring, credit, safety-critical operations, customer-facing agents) are escalated to a committee or risk board. ISO/IEC 42001 describes an AI management system with leadership, planning, support, operation, evaluation, and improvement clauses that some enterprises pursue as a certifiable framework.[27] NIST AI RMF’s Govern function similarly emphasizes accountability, culture, and mapped policies.[25]

Vendor and contract terms

TopicQuestions buyers commonly put in writing
Data useWhere prompts, files, and embeddings are stored and processed; subprocessors; retention and deletion on exit.
Training opt-outWhether customer inputs and outputs may be used to train or improve models; how opt-out is documented and audited.
IndemnityAllocation of IP infringement, privacy, and third-party claim risk; caps and exclusions.
SecurityEncryption, access control, logging, vulnerability process; breach notice timelines.
SOC 2 / ISOCurrent SOC 2 Type II (Trust Services Criteria) or ISO/IEC 27001 reports; for AI management, ISO/IEC 42001 certification where offered.[49,27]
Service levelsUptime, support, model-change notice, and evaluation rights when the provider swaps underlying models.

Attestations reduce but do not eliminate due diligence. Buyers still map data categories to the contract and to sector law.

Risk assessment: NIST AI RMF and ISO/IEC 42001

NIST AI RMF 1.0 (Jan 2023) is a voluntary U.S. framework organized as Govern, Map, Measure, Manage. The Generative AI Profile (NIST AI 600-1, Jul 2024) adds GAI-specific risks and suggested actions.[25,26] Organizations use it to inventory systems, map harms and stakeholders, measure tests and metrics, and manage residual risk with human oversight.

ISO/IEC 42001:2023 is a certifiable AI management-system standard. It is often paired with information-security controls (ISO/IEC 27001) rather than treated as a substitute for them.[27] As of Nov 3, 2026, adoption is voluntary unless a contract or regulator asks for it.

Compliance obligations under laws already in this handbook

Whether a business is in scope depends on role (provider vs deployer), location of users or decisions, and use case. The rows below point back to measures summarized earlier; effective dates and status are as of Nov 3, 2026.

InstrumentBusiness-relevant duties (high level)Notes
EU AI ActProviders and deployers of in-scope systems face risk-tiered duties (documentation, transparency, human oversight, conformity for high-risk). GPAI and high-risk timelines phase in through 2025–2028.Extraterritorial reach can affect non-EU firms placing systems on the EU market or whose outputs are used there.[21]
Colorado ADMT / Chatbot SafetyAutomated decision-making in consequential decisions; chatbot operator duties for conversational systems.Effective Jan 1, 2027; rulemaking underway as of Nov 3, 2026.[31]
NYC Local Law 144Employers/agencies using covered automated employment decision tools in NYC: independent bias audit within the prior year, public audit summary, and candidate/employee notice.In force; DCWP enforcement since Jul 5, 2023.[48]
Illinois HB 3773Employer notice and anti-discrimination limits when AI is used in covered employment decisions.In force Jan 1, 2026.[34]
Texas TRAIGA (HB 149)Among other duties, government AI disclosure to residents; consumer-facing AG materials describe rights under the Act. Private employers should check which chapters apply to their systems and government contracts.Effective Jan 1, 2026.[1,11]
California SB 53 / AB 2013Frontier/transparency and training-data documentation duties for covered developers; relevant when a firm builds or fine-tunes generative systems at scale.See state table; AB 2013 in force Jan 1, 2026.[29,30]

HR, hiring, and AI

Hiring and promotion tools that score or filter candidates can trigger NYC Local Law 144 bias-audit and notice rules when used in the city, Illinois Human Rights Act AI notice and discrimination limits, and general EEO and state human-rights statutes regardless of “AI” branding.[48,34] Colorado’s ADMT Act (effective Jan 1, 2027) addresses automated decisions in consequential contexts that can include employment.[31] Common corporate controls: vendor bias-audit packages, adverse-impact review, human reconsideration paths, and clear candidate notices. Workforce monitoring and generative drafting of performance reviews raise separate labor and privacy questions that counsel and HR typically handle under existing employment law.

IP and copyright for AI output

As of Nov 3, 2026, U.S. Copyright Office registration guidance (effective Mar 16, 2023) states that material generated by AI without sufficient human authorship is not copyrightable; applicants must disclose AI-generated content and claim only human-authored portions.[50] Corporate IP policies often require staff to track AI assistance in creative and marketing work, avoid pasting third-party copyrighted material into prompts where licenses forbid it, and clarify ownership of outputs in vendor terms. Training-data litigation against model developers continues in U.S. courts; outcomes remain case-specific rather than a single national statute (see Policy topics).

Recordkeeping and incident response

  • RecordsRetain prompts/outputs where they are business records or evidence of a covered decision; align retention with legal holds and privacy minimization.
  • InventoryKeep a living register of AI systems, owners, data classes, vendors, and risk tier.
  • IncidentsDefine what counts as an AI incident (data leak via prompt, harmful autonomous action, discriminatory outcome, deepfake brand misuse) and who is on-call.
  • ResponseContain access, preserve logs, notify per breach and contract clauses, remediate model or process, and document lessons—folded into existing IR playbooks where possible.

Corporate AI policy checklist

  • Written acceptable-use policy with scope, allowed/prohibited uses, and human-review rules.
  • Approved-tools list mapped to data classes; consumer tools barred for confidential data.
  • Named governance owners; committee path for high-risk uses.
  • Vendor terms: data use, training opt-out, indemnity, security, SOC 2 / ISO evidence, subprocessors.
  • Risk assessments using NIST AI RMF (and ISO/IEC 42001 if pursuing a management system).
  • Jurisdiction map: EU AI Act role; Colorado; NYC LL 144; Illinois; Texas TRAIGA; California developer duties.
  • HR/hiring controls and notices where AEDTs or automated decisions are used.
  • IP guidance for AI-assisted works and vendor output ownership.
  • Inventory, retention, and incident-response steps tested at least annually.
  • Employee training and an exception/approval path for pilots.

This briefing is educational and vendor-neutral. It is not legal advice. Confirm obligations with counsel for your jurisdictions, sectors, and contracts.

Sample acceptable-use policy (AUP) outline

Outline only. Adapt with counsel. As of November 3, 2026.

  1. Purpose and scope - roles covered (employees, contractors, vendors on org systems); personal devices; environments (prod, test).
  2. Definitions - what counts as AI / generative AI / agents for this policy.
  3. Approved tools - allow-list, request process, shadow-IT rule.
  4. Data classes - what may / may not be pasted into prompts (public, internal, confidential, regulated).
  5. Human review - when outputs need review before external use or high-stakes decisions.
  6. Prohibited uses - illegal content, covert recording, biometric scrapes, unauthorized surveillance, exam cheating, as applicable.
  7. Attribution and labels - when to disclose AI assistance to customers or the public.
  8. Retention and logging - what the org keeps; vendor retention settings.
  9. Incidents - how to report prompt leaks, harmful outputs, suspected model misuse; link to Incident Tracker examples for training.
  10. Training - onboarding and annual refresh; role-based modules.
  11. Exceptions - who may grant them and for how long.
  12. Related policies - security, privacy, records, code of conduct, IP.

Sample vendor questionnaire (excerpt)

Questions organizations commonly ask AI vendors. As of November 3, 2026. Not a certification.

  1. Where is customer prompt and output data stored (regions), and for how long?
  2. Is customer data used to train or improve models by default? How is training opt-out documented in the DPA?
  3. List subprocessors that can access prompts, files, or embeddings.
  4. What security attestations are current (for example SOC 2 Type II), and for which trust services?
  5. Do you support SSO, SCIM, customer-managed keys, VPC / private networking, or on-prem options?
  6. How are model versions pinned, and how are breaking changes communicated?
  7. What evaluation, red-teaming, or known-limitation documentation is available for the offered model or system?
  8. How does the product support content provenance, watermarking, or export of audit logs?
  9. What is the incident-notification timeline for breaches affecting customer AI data?
  10. Which laws or frameworks have you mapped the product against (EU AI Act role, ISO/IEC 42001, NIST AI RMF), and is that mapping available under NDA?

See also Standards & buying and NIST AI RMF / ISO/IEC 42001 on Sources.

Related incidents (examples for tabletop exercises): AI Incident Tracker Browse verified & reported rows

← For public bodiesHealthcare →