FreeOpen source
AI App Policy Kit
Fifteen free policy templates for small businesses that build or use AI apps. Plain English, written for UK businesses, each with a checklist to fill in.
The fifteen templates
Each is two or three pages: why it matters, the rules, and a register or checklist to fill in. Replace what is in [square brackets] with your own details. Version 1.0, about 1 MB as one zip.
01 AI acceptable use policy
Which AI tools staff may use, and what may go into them.
02 Data protection for AI apps
What personal data you hold, why, where, and what reaches an AI supplier.
03 Access control policy
Who can get in, with their own login and two-step sign-in.
04 Secrets and API keys policy
Keys out of the code, narrow, capped and rotated.
05 AI-written code review standard
What a person checks before AI-written code goes live.
06 Incident response and breach reporting plan
Who does what when something goes wrong, and the ICO's 72 hours.
07 Backup and recovery policy
Backups that have been restored at least once.
08 Supplier and AI vendor checklist
The questions to ask before your data goes to a supplier.
09 AI risk assessment template
What could go wrong with an AI feature, written down before launch.
10 Data retention and erasure policy
How long data is kept, and deleting a person's data everywhere.
11 Logging and monitoring standard
Knowing when someone got in, and what they did.
12 Change and release policy
The steps between "it works on my screen" and customers using it.
13 Human oversight of AI decisions
Where a person must check, approve or be reachable.
14 Model and prompt security standard
Prompt injection, and limiting what a model can reach and do.
15 Staff training and awareness record
Evidence that people were told.
Where to start
You do not need all fifteen on day one.
1. This week
They stop the most common losses and need nothing more technical than switching things on.
2. This month
- 02 Data protection for AI apps
- 06 Incident response and breach reporting plan
- 07 Backup and recovery policy
Fill in the data map and the contacts table, and restore one backup.
3. Before an AI feature launches or grows
- 08 Supplier and AI vendor checklist
- 09 AI risk assessment template
- 13 Human oversight of AI decisions
- 14 Model and prompt security standard
Check the supplier, write down the risks, and limit what the AI can do alone.
4. As you settle in
- 05 AI-written code review standard
- 10 Data retention and erasure policy
- 11 Logging and monitoring standard
- 12 Change and release policy
- 15 Staff training and awareness record
Review, retention, logs, releases and training.
Free to use, change and share
Open source under CC BY 4.0: use it, change it and share it, commercially too, with credit to PuglieseWeb LTD. Your own filled-in policies need no credit line.
The source is on GitHub. Corrections and improvements are welcome as an issue or a pull request.
These templates are a starting point, not legal advice. They follow UK GDPR and the guidance of the ICO and the NCSC. Regulated sectors such as health, finance and work with children have further rules; if in doubt, ask a solicitor.
Want someone to check your app against the kit?
Book a free Software Health Check. Five a month.
Book your free Software Health Check