Draft an internal AI governance policy scoped to how your teams are actually using AI, not a boilerplate framework

Draft a first-pass internal AI governance policy based on how our organization actually uses AI tools today, structured so legal and compliance have a concrete starting point to revise rather than a blank page.

HOW AI IS CURRENTLY USED HERE
Marketing uses ChatGPT for draft copy; engineering uses GitHub Copilot; customer support has piloted an AI chatbot for tier-1 tickets; no formal approval process exists yet.

RISK AREAS WE'RE MOST CONCERNED ABOUT
Concerned about customer PII being pasted into consumer AI tools, and about AI-drafted external communications going out without human review.

EXISTING APPROVAL OR PROCUREMENT PROCESS, IF ANY
New software generally goes through IT security review, but AI tools specifically haven't been routed through that process consistently.

REGULATORY CONTEXT WE'RE AWARE OF
We operate in the EU and US and are aware AI-specific regulation is an emerging area we need legal to track.

STRUCTURE THE POLICY IN THESE SECTIONS
Scope: state plainly what this policy covers (which tools, which use cases, which employees) based on what I've told you is actually happening, not a generic "all AI use" statement that doesn't reflect reality. Risk tiers: sort AI use cases we've described into tiers by consequence if something goes wrong (e.g. AI used for internal brainstorming vs. AI used to draft anything sent externally or make a decision about a person), and state a different approval requirement per tier rather than one blanket rule for everything. Approval workflow: describe, based on what I've told you about our existing process, who needs to approve a new AI tool or use case before it's adopted, and what information that approver needs to see. Data handling rules: state what categories of data should never be input into a general AI tool (based on what I tell you is sensitive here), phrased as a rule for employees to follow, not a restatement of a data protection law's requirements. Incident and misuse reporting: describe how an employee should report a suspected AI-related error, hallucination, or misuse, and who reviews it.

WHAT NOT TO DO
Do not cite a specific AI regulation, its provisions, or its compliance deadlines unless I've explicitly told you the citation and its content — regulatory frameworks in this space are new, changing quickly, and vary by jurisdiction, so state only in general terms that regulatory compliance is a consideration, and flag it as something legal needs to confirm against current law. Do not present any section of this draft as final or already-approved language — every section header should make clear this is a draft under active development, not a live policy an employee could be told to already follow.

OUTPUT FORMAT
A structured policy draft with the five sections above, each opening with "DRAFT —" to make its status unambiguous. End with an explicit statement that this entire document is an internal working draft only, has not been reviewed or approved by legal or compliance, must be reviewed by a qualified lawyer for accuracy against current and applicable law before any part of it is adopted, and should not be distributed to employees as an active policy until that review is complete.