The AI policy your insurer is going to ask for, written in twenty minutes

The request for a written AI acceptable-use policy arrives at a small company before anyone inside it has decided what the policy should say. That ordering is the whole problem. A board member asks whether one exists, or a cyber-insurance renewal form carries a line for it, or an enterprise customer's vendor questionnaire wants a copy attached, and the owner, who has no in-house counsel and no particular wish to pay for one, goes looking for a template. The template arrives with its hard parts left as bracketed fields, and the request, which was really a request for a set of decisions, gets answered with a document that contains none.

This piece walks through the nine decisions that document has to make, shows why a template cannot make any of them for you, and ends with the way we have built to make them once and get a signed document out the other side. It is written for the owner who got the question this week, not for lawyers.

What the question is actually asking

When an insurer or a customer asks whether you have an AI policy, they are not asking whether you have a file with that title. They are asking whether the company has decided how its people may use tools that accept text, files, and images and return something generated in response, and whether that decision has been written down, dated, and approved by someone with the authority to approve it. The form reduces this to a yes-or-no line because a form has to, but the underwriter behind the form is pricing the difference between a company that has made those decisions and one that has not.

A policy, in this sense, is not a piece of writing. It is a record of choices. The writing exists so the choices can be shown to someone else.

The nine decisions

Every AI acceptable-use policy that does real work answers the same nine questions, and the ones that do no work are the ones that leave them open.

Company profile. Who the policy covers, which entity adopts it, and who is responsible for keeping it current. Without this, nothing that follows has an owner.

Approved and banned tools. Named by category and by vendor: which general assistants, which coding tools, which transcription or meeting tools, and which are prohibited outright. The category matters because new vendors appear constantly; the vendor matters because your people need to know whether the one they already use is on the list.

Data classes and what may be entered. Which kinds of information may be given to an approved tool, which may be given only in redacted form, and which may never be entered at all. This is the clause that protects customer records, payroll, contracts, and anything covered by a confidentiality agreement, and it is the clause most often left blank, because answering it requires admitting what has already been pasted.

Disclosure to customers. Whether, and when, the company tells customers that AI was used in producing something delivered to them. There is a defensible answer in either direction. There is no defensible answer in leaving it unstated.

Human review of AI output. What must be checked by a person before it leaves the building, and who that person is. Code, contracts, published copy, and anything sent under the company's name are the usual candidates.

Procurement and vendor rules. How a new AI tool gets approved, who signs the terms, and what the company requires of the vendor regarding training on its data. This is the clause that stops the policy from being obsolete the day after it is signed.

Incident reporting. What counts as a breach of the policy, whom it is reported to, and within what time. An unreported paste of confidential data into an unapproved tool is an incident whether or not anyone calls it one.

Training. Who is told about the policy, how, how often, and how the company records that they were told. The insurer's next question, after "do you have one," is "does anyone know what it says."

Enforcement. What happens when the rule is broken, and who decides. A policy with no consequence is a suggestion with a cover page.

Why the brackets stay square

A template presents these nine as fill-in fields because the template's author cannot know your answers. That is not a flaw in the template; it is the definition of one. The flaw is in what happens next. The owner opens the file intending to fill it in, reaches the data clause, realizes that answering it honestly means naming which tools people already use and which data has already gone into them, and closes the file. The document goes into a shared drive with a confident filename. The vendor form gets a yes.

The template did not fail. The template is not the policy. Filling in the brackets is the policy, and the brackets are precisely the parts that require a decision from someone with the standing to make it. No downloaded document can supply that, and a lawyer's draft, at four figures, mostly supplies it by asking you the same nine questions across a billable hour.

Answering the nine once

The alternative we have built is a questionnaire of about twenty plain-language questions, organized under the nine sections above, that produces a finished policy from your answers rather than a template around them. Each answer changes the text: conditional clauses appear or drop depending on what you decided, so no bracketed field survives into the output and no two companies receive the same document. You read the first two sections in full before paying. When you are done, the policy exports as a DOCX and a PDF with a board memo cover page stating the effective date, the approver, and the scheduled review date, and it reads as your company's document, not ours. The answers stay in your account, so that when a tool is added or a customer asks a harder question, you edit an answer, regenerate, and keep a version list showing what changed and when. The whole run takes under twenty minutes.

None of this makes the nine decisions for you. Nothing legitimately can. What it does is refuse to let you skip them, and then hand you the receipt.

The AI Policy Builder, and the free ten-question readiness checklist that precedes it, are at freebeer.ai/deals.