AI Tool Adoption Policy

How to use this document

• What it is for. This is a base policy that governs how AI tools are requested, classified, assessed, approved, configured, reviewed and retired, including AI features that appear inside software already contracted. Its practical goal is that every AI tool used with the organization's information has passed a filter proportionate to its risk, and that unauthorized AI is detected and brought under control.
• Who should own it. The AI lead, together with information security. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Choose the modules. Use the "Module selection" table. The core covers purchased tools (assistants and AI features in contracted software). Add the modules for API integration, self-hosted models, training or agents only if you use them.
• Decisions to take first. Before adopting it, decide whether there will be an amnesty period for unauthorized AI already in use (Section 11), which technical controls you will use to detect it and how often each tool is reassessed (Section 13). Approval lanes, deadlines and escalation thresholds come from the "AI Governance Operating Model"; do not redefine them here.
• Fields to complete. Replace the bracketed fields. Keep [OPTIONAL] clauses only if they apply.
• Relationship with other documents. This policy defines the adoption process. The "Responsible AI Use Policy (Including Generative AI)" defines what staff may do with approved tools; the "AI Vendor Management Policy" defines contractual and vendor monitoring requirements; the "AI Tool Selection and Evaluation Guide" explains how to compare options.
• Country variants. No country variants. Use "Related regulatory references" to identify rules that add requirements to the assessment, for example in data protection or regulated sectors.
• Review. Ask legal, the data protection officer (or the country's equivalent role) and information security to validate the minimum assessments for each level.
• Approval and publication. Have it approved by management or the AI committee, record the approval in "Version history," publish it on the intranet together with the request form and communicate it to all staff, especially those who buy or administer software.

Module selection

Profile or level	What to keep
P1: uses AI inside software it buys (assistants, AI features in SaaS)	Core: Sections 1 to 11 and 13 to 17
P2: integrates models through APIs or RAG	Core and Section 12.1 [MODULE P2]
P3: hosts models on own or rented infrastructure, including open-weight models	Core and Section 12.2 [MODULE P3]
P4: trains or fine-tunes models	Core and Section 12.3 [MODULE P4]
P5: uses agents that act in systems	Core and Section 12.4 [MODULE P5]
Basic level (fewer than about 50 people, P1 only)	Core and the paragraphs marked [BASIC LEVEL]; omit Section 12
Reinforced level (high risk, regulated sector or P3 to P5 in production)	Core, applicable modules and the paragraphs marked [REINFORCED LEVEL]

Profiles are cumulative: an organization can be P1, P2 and P5 at the same time. Delete the modules and level paragraphs that do not apply and remove the markers from those you keep.

AI Tool Adoption Policy

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Policy owner	[OWNER]
Profiles and level adopted	[COMPLETE: e.g., P1 and P2, Standard level]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Request channel	[AI GOVERNANCE EMAIL]

1. Purpose

1.1 The market constantly offers tools that include AI, and vendors add AI features to products the organization already uses. These tools can deliver a lot of value but also carry risks that are easy to miss: leakage of confidential information, use of our data to train third-party models, wrong or biased outputs, vendor lock-in and new legal obligations.

1.2 This policy sets a single, fast, risk-proportionate process for bringing AI tools into [ORGANIZATION NAME]. Its objectives are:

a) every AI tool used with the organization's information is authorized, configured and recorded in the "AI System Inventory";
b) the depth of review depends on risk, so simple cases are approved quickly and high-impact ones get a full analysis;
c) reduce unauthorized AI by offering a clear and fast way to request tools;
d) keep evidence of why each tool was approved, approved with conditions or rejected;
e) keep the use of AI tools within the risk appetite (see "AI Risk Appetite Statement").

2. Scope

2.1 This policy applies to any tool that contains or depends on AI for its main function or for relevant features, including:

a) cloud services and generative AI applications (chat assistants, image, audio or video generators, coding assistants, transcription tools);
b) software with built-in AI for a specific function (sales, marketing, human resources, customer service, finance, security);
c) AI features switched on inside software already contracted, such as office suites, CRMs, video conferencing or document management platforms;
d) third-party APIs and models integrated into in-house systems;
e) open-source or open-weight models run on own or rented infrastructure;
f) browser extensions, plug-ins and mobile apps with AI;
g) AI agents able to take actions in other systems;
h) devices and hardware with built-in AI.

2.2 It applies to paid and free tools, to trials and pilots, and to tools contracted by a function without IT involvement.

2.3 Excluded, unless [AI COMMITTEE] decides otherwise:

a) AI features that run only on the user's device and send no information off it, such as the operating system's spell checker;
b) [COMPLETE] (other exclusions with objective criteria approved by the AI committee).

2.4 This policy applies to all staff, contractors and any third party that uses tools with the information or resources of [ORGANIZATION NAME].