AI governance · template updated October 2026
AI Policy Template for Companies in India: 12 Clauses to Copy
The template at a glance
Twelve clauses every company AI policy needs
Most Indian companies already have employees using AI, approved or not. A short, clear policy turns that into managed use: people know what is allowed, managers know what to check, and the company can show a client or auditor how it handles AI. The clauses below follow the order in which employees usually need answers.
- Purpose and scope: who and what the policy covers
- Approved tools and accounts: the list, and how to request a new tool
- Data tiers for AI use: what information may go where
- Personal data and the DPDP Act: customers, employees and candidates
- Client and third-party confidentiality: contracts and NDAs come first
- Human review and accountability: a named person owns every output
- Disclosure and labelling: when to say AI was used
- Intellectual property: inputs, outputs and code
- Prohibited uses: the short list of never-do items
- AI agents and automations: permissions, logs and kill switches
- Training and AI literacy: what each role must complete
- Incidents, enforcement and review: reporting, consequences and updates
Owners and review cycle
Who owns each clause, and how often to revisit it
| Clause | What it decides | Usual owner | Review |
|---|---|---|---|
| 1. Purpose and scope | People, entities and tools covered | Policy owner (often CIO or COO) | Yearly |
| 2. Approved tools | Which AI tools and accounts are allowed | IT and security | Quarterly |
| 3. Data tiers | Which information may go into which tool | Information security | Every six months |
| 4. Personal data | DPDP Act duties for AI use | Data protection lead or legal | When rules change |
| 5. Confidentiality | Client and partner obligations | Legal and account leads | Per contract |
| 6. Human review | Who checks and signs off outputs | Function heads | Every six months |
| 7. Disclosure | When AI use must be stated | Marketing and legal | Every six months |
| 8. Intellectual property | Ownership of inputs and outputs | Legal | Yearly |
| 9. Prohibited uses | The non-negotiables | Policy owner | Every six months |
| 10. Agents | Automations that act on systems | IT and the business owner | Quarterly |
| 11. Training | Required learning by role | HR and L&D | Yearly |
| 12. Incidents | Reporting, consequences, updates | Security and HR | After each incident |
Owners are suggestions. Smaller companies often give most clauses to one person, such as the COO, with legal advice on clauses 4, 5 and 8.
The template
The twelve clauses, with sample wording
Each clause explains why it matters, gives wording to adapt, and lists what tends to work and what to avoid. Replace anything in [square brackets].
Clause 1. Purpose and scope
Scope disputes are the most common reason a policy gets ignored: “I am a consultant, so it does not apply to me,” or “this is a browser plug-in, not an AI tool.” Define people and tools broadly, then let the other clauses do the detailed work.
This policy sets out how [Company] and its group entities use artificial intelligence tools, including generative AI assistants, AI features inside business software, and AI agents. It applies to all employees, interns, contractors, consultants and anyone else who works with [Company] information or systems, on company or personal devices.
The aim is to let people use AI productively while protecting customers, colleagues, clients and the company.
- Name AI features inside existing software, not just chatbots
- Cover personal devices used for work
- State the purpose positively
- Defining AI so narrowly that new tools fall outside it
- Long definitions copied from regulations
- Exempting senior staff
- Owner
- Policy owner, often the CIO, COO or a governance lead
- Covers
- Employees, interns, contractors, consultants
- Tools
- Assistants, AI features in software, agents
- Links to
- IT acceptable use, information security and data protection policies
Clause 2. Approved tools and accounts
Business plans of the major assistants come with written data terms that consumer accounts do not. OpenAI, for example, states that it does not train its models on business data from ChatGPT Business and Enterprise by default, and Microsoft states that Copilot prompts and responses are not used to train foundation models. Those protections only apply if people use the company account.
Only AI tools listed in the Approved AI Tools Register may be used for [Company] work, and only through accounts provided or approved by [Company]. Personal AI accounts must not be used with any information above the Open tier (see Clause 3).
To request a new tool, submit the AI tool request form to [IT/security contact]. Requests are reviewed for data terms, security and cost within [10] working days.
- Keep the register short and current
- Publish a simple request route
- Record the plan and data terms for each tool
- Banning all AI, which pushes use underground
- Approving tools without reading data terms
- A request process with no deadline
- Owner
- IT and information security
- Register fields
- Tool, plan, data terms, approved tiers, owner
- Review
- Quarterly, and when a vendor changes terms
- Vendor sources
- OpenAI enterprise privacy; Microsoft Learn enterprise data protection
Clause 3. Data tiers for AI use
Employees need a quick test they can apply in the moment. Four tiers, matched to the tools in the register, work for most companies and line up with existing information-classification schemes.
Before entering information into an AI tool, classify it:
Open: published or public information. May be used in any approved tool.
Internal: routine internal material such as non-sensitive process documents. Approved business accounts only.
Confidential: client material, financials, pricing, strategy, source code. Only tools approved for Confidential data in the register.
Restricted: sensitive personal data, credentials, unreleased results, legal privileged material. Not to be entered into AI tools unless [the policy owner] has approved a specific, documented use.
- Give two or three examples per tier from your own business
- Map each approved tool to the highest tier allowed
- Tell people to remove names and identifiers where possible
- Inventing tiers that differ from your existing classification
- Leaving “client data” undefined
- Relying on people to judge tiers with no examples
- Owner
- Information security
- Tiers
- Open, Internal, Confidential, Restricted
- Rule of thumb
- If unsure, treat it as the higher tier
- Works with
- Sensitivity labels in Microsoft 365 or Google Workspace
Clause 4. Personal data and the DPDP Act
The Digital Personal Data Protection Act, 2023 applies to digital personal data, whether you process it yourself or through an AI vendor. The DPDP Rules were notified on 14 November 2025 with an 18-month phased timeline, so obligations are arriving through 2026 and 2027. In general terms, the Act’s principles include purpose limitation, data minimisation, security safeguards and accountability. Your policy should translate those into AI behaviour.
Personal data of customers, employees, candidates or any other individual may be processed with AI only for a purpose that [Company] has a lawful basis for, only in tools approved for that tier, and only to the extent necessary. Wherever a task can be done with anonymised or masked data, it must be. AI vendors that process personal data on [Company]’s behalf must be covered by a written contract. Questions go to [data protection contact].
- Mask names and IDs before analysis where possible
- List which tools may process personal data
- Check vendor contracts cover processing and deletion
- Uploading full HR or customer exports “to see what AI finds”
- Assuming a vendor’s marketing page is a contract
- Ignoring candidate data in hiring tools
- Owner
- Data protection lead or legal
- Law
- DPDP Act, 2023 and DPDP Rules, 2025
- Timeline
- 18-month phased compliance from November 2025
- Note
- General summary, not legal advice
Clause 5. Client and third-party confidentiality
For services firms, client contracts are often stricter than the law. Some clients ban AI on their data entirely; others require notice or approval. The policy must make contracts win over convenience.
Information received from clients, partners or suppliers may be used with AI only where the relevant contract or NDA allows it. Where a contract is silent, treat the information as Confidential and confirm with [account lead/legal] before using AI. Client-specific restrictions must be recorded in [the client register] and followed by everyone working on that account.
- Add an AI question to client onboarding
- Keep client AI restrictions where teams can see them
- Brief new joiners on high-restriction accounts
- Assuming silence in a contract means permission
- Using one client’s material to produce work for another
- Forgetting subcontractors and freelancers
- Owner
- Legal and account leads
- Applies to
- Clients, partners, suppliers, subcontractors
- Default
- Contract silent = Confidential tier
- Record in
- Client or contract register
Clause 6. Human review and accountability
AI can produce confident, wrong answers: invented figures, outdated rules, citations that do not exist. The fix is simple to state and hard to practise: a named person checks and owns anything that leaves the team.
The person who uses AI to produce work is responsible for it as if they had written it themselves. AI output must be checked for accuracy, completeness and tone before it is shared outside the immediate team, sent to a customer or client, or used in a decision. Decisions that significantly affect an individual, such as hiring, performance, credit or pricing for a named customer, must not be made by AI alone.
- Define what “checked” means for your key outputs
- Keep sources for facts and figures
- Make reviewers part of the workflow, not optional
- “The AI said so” as an explanation
- Review steps that exist only on paper
- Fully automated decisions about people
- Owner
- Function heads
- Principle
- The user owns the output
- High-stakes
- Hiring, performance, credit, pricing, legal
- Evidence
- Keep prompts and sources for key outputs
Clause 7. Disclosure and labelling
Not every AI-assisted email needs a label, but some outputs do: client deliverables where the contract asks, published images or video that look real, and anything where a reader would feel misled. In February 2026 MeitY also amended the IT Rules to require platforms to label synthetically generated content, a sign of where expectations are heading.
Employees must disclose AI use where a client contract, regulator or [Company] guideline requires it, and wherever a reasonable reader would expect to know. Images, audio or video generated or substantially altered by AI that depict realistic people, places or events must be labelled as AI-generated when published. AI must never be used to impersonate a real person.
- List the outputs that always need disclosure
- Use one standard label for published media
- Tell clients how AI is used in your delivery
- Labelling everything, so labels mean nothing
- Realistic AI images of real employees or customers without consent
- Hiding AI use when a client has asked
- Owner
- Marketing, communications and legal
- Always label
- Realistic AI images, audio and video you publish
- Context
- IT Rules amendment on synthetic content, February 2026
- Never
- Impersonating a real person
Clause 8. Intellectual property
Two IP questions come up constantly: may I paste in material we do not own, and who owns what comes out? The policy should settle the first and route the second to legal.
Do not enter third-party material into AI tools unless [Company] has the right to use it that way. Work created with AI in the course of employment belongs to [Company] to the same extent as other work. Source code generated by AI must pass the same review, security scanning and licence checks as any other code before it is merged.
- Check stock, font and software licences for AI use
- Keep code review and scanning for AI-written code
- Ask legal about client ownership clauses
- Uploading paid reports or books you only licensed for reading
- Merging AI code without review
- Promising clients exclusive rights you cannot confirm
- Owner
- Legal, with engineering for code
- Inputs
- Only material you have rights to use
- Outputs
- Owned by the company like other work
- Code
- Same review and licence checks
Clause 9. Prohibited uses
A short, specific list is remembered; a long one is not. Keep it to items that would cause real harm and that no business reason can justify.
The following are prohibited: entering Restricted information into unapproved tools; using AI to make decisions about individuals without human review; creating deepfakes or impersonating any real person; generating content that is unlawful, discriminatory or harassing; using AI to bypass security controls or access systems without authorisation; and presenting AI-generated research, citations or figures as verified without checking them.
- Explain each item with one example
- Revisit the list after incidents
- Keep it on one screen
- Lists of twenty vague items
- Banning whole categories of tools without reasons
- Prohibitions nobody enforces
- Owner
- Policy owner
- Length
- Five to eight items
- Review
- Every six months
- Consequence
- See Clause 12
Clause 10. AI agents and automations
AI is moving from answering questions to taking actions: updating records, sending messages, moving files. Agents need the same controls as any system account, plus a clear human owner.
AI agents and automations that can read from or act on [Company] systems must be approved by IT before use. Each must have a named business owner, access limited to what the task needs, activity logging, and a way to switch it off. Agents may not send external communications, make payments or change records of individuals without human approval unless the policy owner has approved that specific automation.
- Start agents in read-only or draft mode
- Review agent permissions quarterly
- Log what agents did and why
- Connecting agents to every system “to be useful”
- Agents without an owner
- Letting agents email customers unsupervised
- Owner
- IT plus a named business owner
- Controls
- Least access, logging, off switch
- Approval
- Needed for external actions
- Review
- Quarterly
Clause 11. Training and AI literacy
A policy people have not practised is a policy they will break by accident. Short, role-based training on approved tools does more than a signed acknowledgement.
All staff must complete [Company]’s AI essentials training within [30] days of joining or of this policy taking effect, and a refresher every [12] months. Roles that handle Confidential or Restricted data, managers who approve AI outputs, and owners of AI agents must complete additional role-specific training. Completion is tracked by [HR/L&D].
- Teach the data tiers with your own examples
- Practise on real tasks in approved tools
- Train managers to review AI output
- A slide deck and a quiz as the whole programme
- Training on tools you have not approved
- Skipping senior leaders
- Owner
- HR and L&D
- Everyone
- AI essentials plus yearly refresher
- Extra for
- Managers, sensitive-data roles, agent owners
- Evidence
- Completion records
Clause 12. Incidents, enforcement and review
People will make mistakes, such as pasting the wrong file into the wrong tool. Fast reporting matters more than blame, and a clear route helps meet breach-notification duties under data protection law.
Report any suspected misuse of AI or exposure of information through an AI tool to [security contact] immediately, and in any case within [24] hours. Prompt, good-faith reporting will be taken into account. Breaches of this policy may lead to disciplinary action under [Company]’s code of conduct. The policy owner reviews this policy at least every [six] months and after any significant incident or change in law.
- Make reporting quick and blame-free
- Rehearse one incident scenario a year
- Publish what changed after each review
- Punishing honest reports
- No named owner for reviews
- Letting the policy go stale for years
- Owner
- Security and HR
- Report within
- [24] hours
- Review
- Every [six] months and after incidents
- Links to
- Incident response and disciplinary policies
Where Skillopedia fits
A policy sets the rules. Training makes them habits.
Skillopedia does not write legal policies or sell AI software. We are a training firm (Skillopedia LLP, Mumbai, est. 2017) that has worked with 335+ organisations across 13 sectors, and we run live, in-company AI literacy training for employees built around each client’s own policy and approved tools.
Teams practise the data tiers on their own documents, learn how to check AI output before it leaves the team, and leave with prompts and review steps for the tasks they do every week. For leadership teams deciding what the policy should allow, see our AI for CXOs and business leaders programme. Participants rate our programmes 4.8/5 on average (300+ surveyed).
Adapting the template
How to fit the template to your company
Start-ups and small firms (under 100 people). Use all twelve clauses but keep each short. One owner, usually the founder or COO, with a lawyer reviewing clauses 4, 5 and 8, is enough.
Mid-size companies. Split ownership as in the table above, publish the tools register on the intranet, and link the policy to onboarding. Most effort goes into Clause 3 examples and Clause 11 training.
Regulated sectors and listed companies. Banks, insurers, healthcare and listed firms should check sector regulators’ expectations as well as the DPDP Act, and connect the policy to model risk, outsourcing and board reporting. The India AI Governance Guidelines released by MeitY in November 2025 are a useful, non-binding reference for principles. If you want help turning the policy into everyday practice, talk to us.
Questions to settle first
- Which AI tools are people already using?
- Which client contracts restrict AI?
- Who will own the tools register?
- Which decisions about people involve AI today?
Red flags in a draft
- A blanket ban with no approved alternative
- No examples for the data tiers
- No owner or review date
- Rules for chatbots but nothing on agents
For the leadership team
- Where do we want AI used more, not less?
- What risk are we not willing to take?
- How will we know the policy is followed?
- Who reports on AI use to the board?
A rollout plan
Thirty days from draft to everyday practice
Issuing the policy is the middle of the job, not the end. This plan suits companies of 50 to 5,000 people.
Rules to reference
The Indian rules an AI policy should point to
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025. The main law for personal data, including data handled through AI tools. The Rules were notified on 14 November 2025 with an 18-month phased timeline.
India AI Governance Guidelines (MeitY, November 2025). A non-binding framework with seven guiding principles and practical guidance for industry. MeitY has said it prefers using existing laws where possible.
IT Rules amendment on synthetic content (February 2026). Requires intermediaries to label synthetically generated content. Most companies are not platforms, but the direction supports labelling realistic AI media you publish.
Sector regulators and contracts. Banking, insurance, securities and healthcare regulators, as well as client contracts, may add requirements on outsourcing, data location or model risk.
Measuring it
How to tell whether your AI policy is working
A policy works when people follow it without thinking about it. Track a few signals from launch, then report them to the leadership team each quarter.
| Signal | How to measure | When |
|---|---|---|
| Awareness | Share of staff who completed AI essentials training | Monthly until complete |
| Approved use | Active users on approved business accounts | Monthly |
| Shadow use | Requests for new tools and blocked unapproved sites | Quarterly |
| Incidents | Reported AI-related incidents and time to report | Quarterly |
| Clarity | Questions received about the policy, by clause | After launch and each review |
For HR, L&D and governance leads
Have a policy? Help your people live by it.
Tell us your headcount, the AI tools you have approved and where you think the risks are. We reply within one working day, and after a short call you receive a written proposal covering:
- manager briefings on review duties
- hands-on sessions on your data tiers and approved tools
- role-based modules for sensitive-data teams
- a day-30 check on questions and incidents
Ask for a policy-led training proposal
We reply within one working day. No obligation.
FAQ
AI policy template: common questions
What should a company AI policy include?
At minimum: scope, approved tools, data rules, personal data handling, client confidentiality, human review, disclosure, intellectual property, prohibited uses, controls for AI agents, training, and incident reporting with a review cycle. The twelve clauses above cover each of these.
Is an AI policy mandatory for companies in India?
There is no single law that requires a stand-alone AI policy. But the DPDP Act, client contracts and sector regulators create duties that are hard to meet without written rules on AI use, so most companies benefit from one.
How long should an AI policy be?
Four to six pages is usually enough for the policy itself. Put tool lists, examples and how-to guidance in separate documents that can change without re-approving the policy.
Should we ban ChatGPT and other AI tools?
Blanket bans tend to push use onto personal accounts, where the company has no control. Approving business accounts with written data terms, and setting clear data rules, usually reduces risk more than a ban.
How does the DPDP Act affect AI use at work?
Personal data entered into AI tools is still personal data. In general terms, you need a lawful purpose, should use only what is necessary, must protect it and must have contracts with vendors who process it. Take legal advice for specific cases.
What is the difference between an AI policy and AI governance?
The policy is the set of rules for employees. Governance is the wider system: who approves tools and use cases, how risks are assessed, how the board is informed, and how the policy is enforced and updated.
Do we need employees to sign the AI policy?
Many companies ask for an acknowledgement, which helps with enforcement. Training on the policy does more to change behaviour than a signature alone.
How should the policy treat AI agents?
Treat agents like system accounts with a human owner: approve them, limit their access, log their actions, keep an off switch, and require human approval before they act externally.
Can we use this template for free?
Yes. Copy and adapt the wording for your own company. Have your legal, security and HR teams review the final version, because this template is general guidance and not legal advice.
How often should an AI policy be updated?
Review it at least every six months, and after any significant incident, a change in law, or a major new tool. AI products change quickly, so keep the tools register under quarterly review.
Who should own the AI policy?
One named policy owner, often the CIO, COO or a governance lead, with clauses owned by IT, security, legal, HR and function heads. Without a single owner, reviews tend not to happen.
How do we train employees on the AI policy?
Use short, hands-on sessions on approved tools with your own examples of each data tier, plus extra modules for managers and sensitive-data roles. Our AI literacy training guide explains what to cover.
Related
Where to go next
Next step
Turn your AI policy into everyday practice
Tell us about your policy, your approved tools and your teams. We reply within one working day with a few questions, then send a written proposal with a fixed fee.
- Hands-on sessions on your own data tiers
- Manager briefings on review duties
- A day-30 check on questions and incidents
Ask for a policy-led training proposal
Reply within one working day.