AI Policy Template for Businesses and Employers

1. Purpose

[Company name] (the Company) uses artificial intelligence (AI) to work more efficiently and to serve customers well. AI use also creates risks to confidential information, accuracy, customers, employees, and the Company’s reputation. This policy sets the rules for using AI in Company work. Procedures issued under this policy set the details.

2. Scope

This policy applies to employees, [Local decision: contractors, temporary workers, and interns] when they use AI for Company work, on Company devices or networks, or with Company information. It covers stand-alone AI tools, AI features inside software the Company already uses, and AI agents.

3. Definitions

1. Artificial intelligence. [Local decision: Use the definition in Mississippi law, shown here, or adopt your own.] “Artificial intelligence” means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Artificial intelligence systems use machine- and human-based inputs to perceive real and virtual environments; abstract such perceptions into models through analysis in an automated manner; and use model inference to formulate options for information or action. (House Bill 1723, 2026 Regular Session, codified in Chapter 3, Title 1, Mississippi Code of 1972.)
2. AI tool means any software, service, or product feature that uses artificial intelligence to generate content, analyze information, make predictions or recommendations, or take actions.
3. AI agent means an AI tool that can take actions in other systems on its own, such as sending messages, making purchases, changing records, or running code.
4. Approved AI tool means an AI tool the Company has approved under Section 7 for a stated purpose, group of users, and category of information.
5. Confidential information means [Local decision: the categories defined in the Company’s data classification policy, or, if there is none,] nonpublic information about the Company, its customers, employees, suppliers, or partners, including trade secrets, financial information, personal information, contracts, source code, and security information.
6. Higher-risk use means any AI use that (1) informs a decision about hiring, pay, promotion, discipline, termination, or other terms of employment; (2) informs a decision about a customer’s access to credit, insurance, housing, or another significant product or service; (3) communicates with customers or the public without a person reviewing each message first; (4) processes confidential information; (5) allows an AI agent to act for the Company; or (6) affects health, safety, or legal compliance.

4. Principles

Company use of AI will:

• serve a clear business purpose;
• keep people accountable for decisions and work products;
• protect confidential information and personal data;
• be truthful with customers and the public;
• treat applicants, employees, and customers fairly;
• be secure; and
• be checked for accuracy before anyone relies on it.

5. Responsibilities

1. [Local decision: The owner or chief executive] will designate [Local decision: an AI lead or an AI review group] to maintain procedures under this policy, keep the list of approved AI tools, approve higher-risk uses, coordinate training, and coordinate the response to AI-related incidents.
2. Managers will make sure their teams follow this policy and its procedures.
3. Each employee is responsible for any work they produce, send, or approve with AI assistance.

6. Permitted, approved, and prohibited uses

1. Permitted. Employees may use approved AI tools for drafting, summarizing, research, analysis, translation, coding assistance, and routine tasks, subject to Sections 8 through 13.
2. Permitted with approval. Any higher-risk use, and any AI tool that is not yet approved, requires approval under Section 7 before use begins.
3. Prohibited. No one may use AI for Company purposes to:
   1. enter confidential information into an AI tool that is not approved for that category of information;
   2. make a decision about hiring, pay, promotion, discipline, or termination based solely on AI output;
   3. create fake reviews or testimonials, or content that falsely appears to come from a real customer or other person;
   4. create images, audio, or video that falsely depict a real person;
   5. harass, threaten, or discriminate against any person;
   6. get around the Company’s security controls or technology use policies; or
   7. [Local decision: add any other prohibited uses the Company chooses].

7. Review and approval of AI tools

1. Before an AI tool is approved, [the AI lead or review group] will review at least:
   1. the business purpose and the evidence that the tool serves it;
   2. what information the tool collects, how the provider uses, stores, and keeps it, and whether the provider uses Company information to train or improve its products;
   3. contract terms on confidentiality, ownership of inputs and outputs, security, breach notice, and use of subcontractors;
   4. security, including account controls, multifactor authentication, and logging;
   5. known limitations and error rates for the intended use;
   6. for an AI agent, the actions it may take, its spending or transaction limits, how its actions are logged, and who can stop it; and
   7. accessibility for employees and customers with disabilities.
2. This review also applies when software the Company already uses adds AI features.
3. The Company will keep a list of approved AI tools showing each tool’s approved purpose, users, and categories of information.
4. Approval may be limited, paused, or withdrawn when a tool does not serve its purpose or meet these requirements.

8. Confidential information and security

1. Confidential information may be entered only into AI tools approved for that category of information, under contract terms that protect it.
2. Employees will use the least confidential information needed for the task.
3. Personal information about customers and employees will be handled as required by law, by contract, and by the Company’s privacy commitments.
4. AI tools are part of the Company’s cybersecurity program, including access control, multifactor authentication, and incident response.
5. Because AI can imitate voices, video, and writing, employees must confirm unusual requests for payments, credentials, or information through a separate, known contact method before acting on them.

9. Customers, marketing, and public claims

1. Claims about the Company’s products and services, including claims about AI features, accuracy, savings, or results, must be truthful and supported by evidence before they are made.
2. The Company will not create, buy, or publish fake reviews or testimonials, including AI-generated reviews attributed to people who do not exist or did not have the experience described.
3. AI tools that communicate with customers will [Local decision: tell customers they are interacting with AI], give customers a way to reach a person, and be monitored for accuracy.
4. A person will review AI-generated public content, including prices, terms, guarantees, and factual statements, before it is published.

10. Employment and human resources

1. AI may assist with employment decisions but may not be the sole basis for them.
2. AI tools used in recruiting, hiring, scheduling, evaluation, discipline, or termination are higher-risk uses. Before use, they will be reviewed for job-relatedness, effects on groups protected by law, accessibility, and the vendor’s evidence.
3. Applicants and employees may ask for a reasonable accommodation or [Local decision: an alternative process] when an AI tool is part of an employment process.
4. [Local decision: State whether and how the Company tells applicants and employees when AI is used in employment decisions. Some states require notice.]
5. Using AI to monitor employees requires approval by [Local decision: human resources and legal counsel].

11. Intellectual property, content, and records

1. Employees must respect intellectual property, license terms, and confidentiality obligations to others, and may not upload material the Company does not have the right to use in that way.
2. AI output must be reviewed for accuracy, originality, and rights before external use. Material generated entirely by AI may not be protected by copyright.
3. Prompts, outputs, and related records used for Company decisions will be kept or deleted under [Local decision: the Company’s records retention schedule].

12. Software and automations built with AI

1. Scripts, applications, websites, integrations, low-code workflows, and agents created with AI must meet the Company’s software, data, and change-control requirements, including software that contains no AI when it runs.
2. Permission to use a coding tool does not authorize deploying its output. Review under [Local decision: the Company’s change-control process] is required before AI-built software uses confidential information, receives privileged access, is shared, or is relied on for operations, including scheduled internal use.
3. The Company will record each authorized release with its business owner, technical maintainer, review evidence, known risks, and reassessment date.
4. [Local decision: Optional. The authorized policy owner must establish this evaluation lane.] Within a documented scope approved by [Local Authority], technical staff may test permitted models on Company-controlled systems without approval for each trial. Record permitted models and data, excluded technologies, network and telemetry limits, security controls, the owner, and stop conditions. Use no confidential information, and send no prompts, data, or telemetry outside approved systems. This lane does not waive acquisition, security, licensing, or data requirements. Operational reliance, sharing, new access, disclosure, or consequential actions require review under Section 7.

13. AI agents

1. An AI agent may act for the Company only within the systems, information, actions, and spending or transaction limits approved under Section 7.
2. Each AI agent will have a named person who is responsible for it and who can stop it.
3. A qualified authorized person must review and approve each proposed contract acceptance, payment, public statement, system-of-record change, or other consequential action before execution. Approval of a tool, workflow, or transaction limit does not replace that review. Any advance permission for low-consequence actions must be expressly defined in adopted policy, enforced by technical limits, and exclude actions that require individual review.
4. Agent actions will be logged and reviewed [Local decision: at a set frequency].

14. Incidents

Employees must report AI-related incidents to [office or person] promptly. Incidents include exposure of confidential information, false statements to customers, harmful or discriminatory output, unauthorized use of AI tools, and fraud attempts that use AI. Incidents will be handled under the Company’s incident response procedures, including notice to affected people where law or contract requires it.

15. Training

The Company will provide training on this policy before employees use AI for Company work. Training covers approved tools, rules for confidential information, checking AI output, recognizing AI-enabled fraud, and reporting incidents. Employees must complete [Local decision: the required training] before any higher-risk use.

16. Compliance and review

1. Violations of this policy may result in [Local decision: discipline under the Company’s usual procedures, up to and including termination].
2. [The AI lead or review group] will review this policy at least [Local decision: once a year] and when relevant law, tools, or business needs change, and will report to [owner, chief executive, or board] on approved tools, incidents, and recommended changes.

Legal references

Legal references. [Local decision: Confirm with counsel and keep only those that apply.]

• Federal Trade Commission Act, Section 5, 15 U.S.C. § 45
• Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465
• Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e et seq.
• Americans with Disabilities Act, Title I, 42 U.S.C. § 12111 et seq.
• Age Discrimination in Employment Act, 29 U.S.C. § 621 et seq.
• Section 75-24-29, Mississippi Code of 1972 (notice of breach of security)
• House Bill 1723, 2026 Regular Session (definition of artificial intelligence)

Laws of other states where the Company has employees or customers: [Local decision: for example, Illinois Public Act 103-0804 or Colorado Senate Bill 26-189]. Cross-references: [technology acceptable use; information security; data classification; privacy; records retention; equal employment opportunity; procurement]