Adapt and Adopt Your AI Policy

01 · Baseline

Choose the baseline and identify authority

Start with the MAIN guide for your organizational setting. Use a sector supplement alongside its stated baseline. A nonprofit operating a clinic, for example, may need both organizational and healthcare review; one label does not settle every obligation. MAIN’s templates are planning resources, not rules adopted for you. [1]

Write down who can adopt or amend policy and which consultation, governance or approval steps actually apply. A business owner, public governing body and college governance process are not interchangeable. Ask the responsible local owner to confirm the route.

Identify related privacy, information-security, records, purchasing, personnel, accessibility and professional requirements. Record the authoritative source, why it applies, who checked it and the date. Treat an unresolved question as an assigned task, with a limit on the affected use while it is resolved. The NIST AI RMF supports documented requirements, roles and proportionate risk management; it is voluntary guidance. [2]

02 · Adaptation

Make a decision about each relevant provision

Read the whole baseline before shortening it. Include AI features in software already in use. Describe actual users, information, outputs and consequences; do not build a policy around an imagined list of products.

Keep

Retain a rule that fits, and identify who will carry it out. A statement requiring review needs an available reviewer and a way to resolve uncertainty.

Change

Replace generic roles, broad permissions or impractical arrangements with specific local decisions. Keep any applicable underlying obligation intact.

Omit

Remove an unused capability or irrelevant example, with a reason. Omitting AI hiring instructions, for example, must not silently permit AI hiring. State the boundary where readers could otherwise infer permission.

Move

Put changing steps in a supporting procedure. Keep the requirement to follow that procedure, its owner and approval authority in the policy.

For each material choice, record the source provision, selected wording, rationale, responsible reviewer and unresolved question. Do not remove a protection simply because the organization is small or has not yet identified who will implement it. Narrow the proposed permission or seek suitable assistance when necessary.

Check the result: can a staff member tell what is permitted, what information is excluded, who checks the work and how to raise a problem?

03 · Document structure

Put the rule, the steps and the examples in the right place

Policy · durable authority

Who is covered; acceptable and restricted uses; information boundaries; human accountability; approval and exception authority; reporting and review responsibilities.

Procedure · assigned steps

How to request a tool, review vendor terms, check an output, keep the necessary records, report an incident or change an approved configuration.

Staff guidance · usable examples

Examples of allowed tasks, prohibited information and questions to ask. Guidance explains the rule; it cannot silently expand permission.

A short policy may incorporate existing procedures by reference. Check that the references are current, accessible to the affected people and owned by someone. MAIN’s Business and Higher Education templates already distinguish these document types. [3] [4]

Separate adopting organizational policy from approving a tool or use and accepting an individual output or action. A policy can establish a review process while a proposed tool remains on hold. Training completion, a signed policy acknowledgement and a successful pilot do not by themselves grant all three permissions.

Use existing resources for the detailed work: the Manufacturing Playbook includes a tool review and pilot decision; the AI Agents Playbook addresses tool permissions and action review; the Cybersecurity Playbook addresses AI security governance. This companion records policy choices rather than repeating those forms.

04 · Annotated fictional example

A small print shop adapts the Business template

Six choices behind the shorter policy

1. Change · Business §5

   Replace a standing committee with assigned people

   Starting idea: designate an AI lead or an AI review group to maintain procedures, approve higher-risk uses and coordinate incidents. Local choice: the owner-manager decides, the shift lead is the backup contact, and the appropriate adviser handles questions beyond their competence. Why: six staff still need clear authority, but a permanent committee is unnecessary for this scenario. See fictional clause F4.

2. Keep and narrow · Business §§6 and 8

   Permit specific drafts using limited information

   Local choice: blank agendas, training outlines and public product copy only; no customer artwork, orders or other nonpublic information. Why: the shop can define the initial tasks without authorizing processing of its client files. See F1–F3.

3. Keep · Business §§9 and 11

   Give review a source and an owner

   Local choice: the preparing employee checks the draft; the owner-manager approves external use. Prices and product claims are checked against current approved business sources. Why: “human review” needs a concrete job. See F5.

4. Omit unused capability · Business §10

   Leave out an AI hiring workflow and retain the restriction

   Local choice: no detailed hiring procedure because AI employment decisions are excluded. Why: shortening the document must not create an accidental permission or remove applicable employment responsibilities. See F3.

5. Move · Business §§7, 11 and 14

   Keep changing steps beside their existing processes

   Local choice: account configuration, vendor questions, records instructions and incident contacts sit in owner-approved procedures. Why: staff can update those steps through their assigned process while policy preserves approval and reporting duties. See F4 and F6.

6. Keep and specify · Business §16

   Choose a review date and earlier triggers

   Local choice: a six-month review, with earlier review after material changes or problems. Why: this is the fictional owner’s chosen cadence, not a legal deadline or a universal MAIN requirement. See F7.

Section references identify the MAIN Business template as revised October 26, 2026. Starting ideas are paraphrased; the annotations and fictional text are MAIN’s teaching adaptation. Privacy and verification boundaries also draw on NIST’s Generative AI Profile. [3] [5]

What this example leaves out: it does not supply rules for a clinic, school, public agency, regulated practice, production-control system or client-data AI service. Use the relevant baseline and specialist review for those settings. Do not transplant this short policy into them unchanged.

05 · Adoption and use

Adopt through the local process, then put the policy to work

Before the authorized decision, reconcile the draft, decision record and supporting procedures. Distinguish a drafting recommendation, an accepted policy choice and an unresolved issue. A reviewer’s comment is not the adoption decision.

• Confirm the adopting authority, required consultation and the exact version for decision.
• Resolve conflicting clauses and identify how existing policies and binding requirements apply.
• Assign each procedure, reviewer, reporting route and update responsibility to an actual owner.
• Record material unresolved questions and their effect on permission. The organization may narrow the policy or hold an affected use rather than grant a broad conditional permission.
• Record the decision, conditions, adoption and effective dates, and where the approved version and supporting record will be kept.
• Explain the rules in an accessible form to affected staff, volunteers or contractors, as applicable. Check that people can find the current tools list, review steps and contacts.
• Set the next policy review and earlier change triggers. Keep policy changes distinct from tool-configuration and individual-action approvals.

Walk through a realistic task before relying on the instructions: a staff member wants to draft a public notice, but the source file includes personal information. Can the person identify the information boundary, find the approver and use the normal process while the question is resolved? Use fictional or otherwise authorized material for the walkthrough.

This is a usability check of the local rules, not proof of compliance or tool safety. Training, documented responsibilities and periodic review align with NIST AI RMF GOVERN 1.5 and 2.1–2.3; the sequence here is MAIN’s recommendation. [2]

06 · Editable decision worksheet

Record the policy choices and the handoff

Download the editable worksheet (.txt) or copy the record into your organization’s approved editor. Use one cover record for the policy and repeat the provision entry for each material choice. Reference protected material by its approved location; do not paste confidential facts into a public worksheet or unapproved AI tool. Bracketed fields are for local completion.

Finish with a decision that can be understood: which version was adopted or returned, who decided, what remains unresolved and what people may actually do next. A blank date, unchecked requirement or unresolved permission must not be presented as approval.