AI Coding Assistant Policy

How to use this document

• What it is for. This is a base policy for the use of AI coding assistants (autocomplete, in-editor chat, automated code review and agent modes that run commands or change repositories). It covers approved tools, secrets and data, licensing and ownership of code, human review and security.
• Who should own it. The CTO, acting as system owner of the approved assistants, with the AI lead, information security, legal (intellectual property and contracts) and the data protection officer (or the country's equivalent role). Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide which tools and plans are approved (section 4), which repositories or types of code are excluded (section 5.3), which public-code matching filters are required (section 7), what level of review generated code needs (section 8) and whether agent modes are allowed (section 10).
• Fields to complete. Replace the bracketed text, such as [ORGANIZATION NAME], [AI COMMITTEE], [AI GOVERNANCE EMAIL] and [COMPLETE]. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This document has no country variants. As of this version's date, no law specific to coding assistants was identified; the policy reflects good practice and connects to the general generative AI guidance listed in "Related regulatory references."
• Client contracts. If you build software for others, review your contracts first: some clients limit or ban AI use, ask to be told about it or ask for assurances about ownership and licensing of the code. Section 9 should reflect those commitments.
• Review. Have your legal counsel review sections 7 (licensing and ownership) and 9 (clients) in particular, and have security validate sections 5, 8 and 10.
• Approval and publication. Approve it, record the approval in "Version history," publish it in the engineering standards repository and collect acknowledgments from the teams (aid F).

AI Coding Assistant Policy

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Policy owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose

[ORGANIZATION NAME] allows the use of AI coding assistants to improve its teams' productivity, provided this does not compromise the confidentiality of code and data, software security, license compliance or obligations to clients. This policy sets the conditions for that use.

2. Scope

2.1. It applies to all staff, contractors and vendors who write, review or maintain code, scripts, infrastructure configuration, database queries or technical documentation for [ORGANIZATION NAME] or its clients.

2.2. It covers any tool that uses AI to suggest, generate, explain, review, test or change code, whether an editor extension, a development environment with built-in AI, a chat assistant, a feature of the code hosting platform or a command-line agent.

2.3. Assistants with an agent mode are also governed by the "AI Agent Policy: Autonomy, Memory and Permissions", which sets the autonomy levels and how they relate to the risk level. Where both policies cover the same point, the stricter rule applies.

2.4. The general rules for staff use of AI are in the "Responsible AI Use Policy (Including Generative AI)"; this policy only adds what is specific to software development.