AI policy template: why a company AI policy comes before the first AI project

A company AI policy comes before the first AI project because every project needs three answers on its first day. You need to know what data the AI may touch, who approves what it does, and who owns it. An ai policy template gives you the headings. The answers are yours, and a project that starts without them stalls.

A company AI policy is a short document that sets out which AI tools staff may use, for which purposes and with what data, who approves the AI's actions, and who owns each system. It is the first deliverable of an AI project, not paperwork after launch.

This guide is part 3 of 3 in our series on the Claude Readiness Workshop. Part 1, "AI workshop for business: what it covers and who should attend", explained the format. Part 2, "AI readiness assessment: how a two-week workshop maps your processes", covered the mapping. This part covers why the work matters: what changes for the business, how you measure the result in time, errors and cost, the risks of doing nothing or doing it badly, and the honest limits.

Every AI project rests on three decisions that only the business can make. A supplier can advise on each one. Nobody outside your company has the authority to settle them.

What data the AI may touch

The data decision is partly a legal one. The ICO states that "purpose limitation requires organisations to have a clear purpose for processing any personal data before they start processing it." If an AI system reads customer emails, you need to have decided why before it reads the first one.

Who approves the AI's actions

The approval decision sets where a person stays in the loop. VKTR recommends human oversight of AI results in risky domains such as hiring, finance, healthcare and legal compliance. It also recommends that employees can override or suspend an AI system whose results appear dangerous.

Who owns the system

The ownership decision cannot be handed to a vendor. The ICO notes that an organisation buying an AI system remains the data controller for the decisions the system makes. Somebody inside your company has to answer for it.

At Svennis we write these three decisions down in the kickoff, before we design a single connector. When a client wants to skip that step, we see the build stall later on a question nobody in the room has the authority to answer.

An AI policy template is a set of headings that each record one decision. Trend Micro's guide to AI company policies lists six key areas: purpose and scope, approved applications, process and usage guidelines, prohibited uses, data privacy and intellectual property, and legal and compliance. The ICO and VKTR add approval, ownership and training. The table shows what each section decides and an example line you could adapt.

Section	The decision it records	Example line
Purpose and scope	Who must follow the policy	Applies to employees and to contractors and agencies working for us.
Approved applications	Which AI tools are allowed	Claude Team is approved. Login credentials are never written into this policy.
Data	What data the AI may use, and how it is stored and protected	Customer names may be processed for ticket routing. Payment details may not.
Prohibited uses	What the AI must never do	No AI-only decisions on hiring or credit.
Approval and oversight	Which actions need a person to sign off	The agent may set a ticket's priority. A person approves every customer reply.
Ownership	Who answers for each system	The head of support owns the routing agent.
Impact assessment	When the risk check happens	A Data Protection Impact Assessment is completed before work begins.
Transparency and training	What people are told and taught	Customers are told when a reply was drafted by AI. All staff complete basic training.

The ICO advises that policies say what the rules are, why they exist and who they apply to. Procedures then explain how to carry the rules out. Keep the two apart, so the policy stays short.

A worked example shows how the policy turns into settings. Picture a company that runs its customer service in Zoho Desk and wants a Claude agent to read each new ticket and send it to the right team. Before anyone builds the agent, the policy fixes seven settings.

1. Data. The agent reads the ticket subject, the body and the requester's name and email. It never sees payment details. Where possible, data is anonymised before the AI processes it, as VKTR recommends.
2. Model. The agent runs on Claude Haiku 5.5, which Anthropic positions for high-volume, latency-sensitive tasks such as classification, extraction and routing.
3. Tools. The agent has no need to search the web, so the administrator disables web search. Anthropic's models documentation confirms an administrator can disable web search, and requests that use it then fail.
4. Account and cost. Claude seats are billed by Anthropic in pounds. The agent's model usage is billed by Amazon Web Services in US dollars and is not capped unless you set a budget. The policy requires the owner to set one.
5. Approval. The agent may set the department and priority. It may not close a ticket or reply to a customer without a person approving. Any agent on the support team may suspend it.
6. Owner. The head of support owns the agent and its results.
7. Transparency. Customers are told when a reply was drafted with AI.

Each of those lines removes a question that would otherwise halt the build halfway through. None of them needs a lawyer to draft. Each one needs a manager to decide.

An AI policy makes results measurable because it names who records the numbers and against what baseline. Without a named owner, nobody counts the before, and nobody can prove the after. Measure three things, and record each one before the AI goes live.

• Time: the hours staff spend each week on the step the AI will take over, such as reading and sorting tickets.
• Errors: how often the step goes wrong first time, for example tickets reassigned to another team after routing.
• Cost: the seat bill in pounds and the model usage bill in dollars, read monthly by the owner.

Model cost is easy to estimate once the data line in the policy says what the AI reads. Anthropic lists Claude Haiku 5.5 from $0.10 per million input tokens and from $0.50 per million output tokens. A token is a small chunk of text, roughly part of a word. Knowing which fields the agent reads tells you how many tokens each ticket uses.

Set a threshold before the pilot starts: the error rate the AI must beat to stay in production. Our guide to scoping a first AI project with a process, a baseline and a threshold walks through setting these numbers for one process.

Starting AI work without a policy does not mean nobody uses AI. It means staff use whatever they find, and the company cannot see it. Trend Micro notes that red teaming, a deliberate attempt to break or misuse a system, can reveal shadow AI deployments and unauthorised access. Shadow AI is AI that staff use for work without the company's knowledge or approval.

The wider risks are well documented. VKTR lists data privacy breaches, biased algorithms and untraceable models among the risks AI brings. Its sources argue that a strong policy stops employees relying blindly on AI outputs. Without approval rules, a wrong answer can reach a customer before anyone checks it.

A bad policy carries its own risks. A policy written by one department alone tends not to match how work is really done, so staff ignore it. The ICO advises consulting relevant staff when drafting policies and procedures, so that they make sense and work in practice. A policy that bans everything has the same effect as no policy. People route around it, and the shadow AI returns.

The cost risk is plainer. An agent's model usage on Amazon Web Services is not capped unless someone sets a budget. A policy that names an owner and requires a budget closes that gap before the first invoice.

A UK company using AI on personal data works under UK GDPR, and the ICO's guidance shapes what a good AI policy contains. Three points from the ICO matter most for a first project.

First, you do not need a separate policy universe. The ICO says it may make more sense to adapt and extend policies you already have, such as data protection and information management policies. Add an AI section to your existing data protection policy rather than starting again.

Second, assess risk before you build. The ICO's guidance on policies and procedures for explaining AI decisions says to state the need for the assessment before work begins on an AI decision-support system. That assessment is likely to be a legally required one, such as a Data Protection Impact Assessment. The level of detail should be proportionate to the risk.

Third, be specific about purpose. In its second call for evidence on generative AI, the ICO says defining a specific and clear purpose for each processing activity is key to data protection by design and by default. It treats developing a model and building an application on that model as different purposes. A business putting Claude to work is building the application, so your purpose describes your process, not AI in general.

The ICO also notes that its guidance is under review because of the Data (Use and Access) Act. Check the current version when you draft.

A company AI policy reduces risk and speeds up decisions, but it does not make any processing lawful on its own. The ICO says its generative AI consultation sets out emerging thinking and should not be read as indicating that any form of processing is legally compliant. Your lawful basis and your impact assessment still have to stand on their own.

A policy also dates quickly if it names specifics. Anthropic published a 2026 Usage Policy update on 8 October 2026, and vendor rules like these change what your staff may do with the tool. Models retire too. Anthropic lists Claude Haiku 5.5 for retirement not sooner than 7 October 2027. A policy that names a model needs a review date.

A policy does not measure quality. It names who measures and against what, but the baseline and the threshold are separate work. A policy also does not train anyone by being published. The ICO advises setting requirements for general staff training and identifying roles that need deeper training.

Finally, keep the policy proportionate. A ten-person firm using Claude Team for drafting needs a page or two. A company letting an agent act on customer records needs more detail, because the ICO links the depth of a policy to how impactful and unexpected the processing is.

The Claude Readiness Workshop is Svennis's two-week service that produces your AI plan, and the policy decisions come at its start. It takes about a day of your team's time on site, plus two short calls: the kickoff and the handover. One of its deliverables is the data answer for the UK: whose account the AI runs on, where the data goes, and what UK GDPR asks of you.

The Workshop starts from your live systems. If you work in Zoho CRM, Zoho Desk or Zoho Books, Svennis pre-fills the questionnaires with Claude from your own data, and you correct them. Without Zoho, the work starts from Xero, Microsoft 365 or Google Workspace through their connectors.

The plan then names how Claude reaches each program. For each connection, Svennis builds a connector, an MCP server, a plugin or a skill, shows you the options with their cost, and you choose. Claude seats, the per-person licences, are not part of the Workshop. They come in with the pilot.

The Workshop is the first of four steps. After it comes Pilot Claude A, an AI agent on Claude for one process, or Pilot Claude B, Claude Team for the whole team. Then comes the department Activation, then monthly operations. A company with paid Claude seats that nobody uses gets Claude Relaunch instead, which includes a short Workshop.

You can draft the core of a company AI policy in a week, before you commit to any project. Work through these steps in order.

1. List the AI tools staff use today, including personal ones. Ask rather than assume.
2. Name one owner for AI in the company, and one owner for each planned system.
3. Write the data line: which data AI may use, which it may not, and why.
4. Write the approval line: which actions need a person, and who can suspend the AI.
5. Add these as a section to your existing data protection policy, and ask the staff who will use the AI to read it.
6. Pick one process and record its baseline in time, errors and cost.

If you are still choosing that process, our overview of AI by business task and the guide on how any company can use AI help you shortlist one.

If you would rather have the decisions, the data answer and the plan produced with you in two weeks, Svennis runs the Claude Readiness Workshop, and its page carries the published prices.