Turn a one-page AI policy into an AI governance programme your company can run
A complete toolkit for compliance, data protection, IT, HR and operations leads in small and mid-size companies: the method, the workbook, the forms, the policy and the exact words, from the first inventory to the quarterly board report.
- A 10-chapter e-book teaching ten building blocks of AI governance, with one composite 100-person company running through every chapter
- The AI Governance Workbook: 15 sheets covering inventory, use-case register with tier formulas, vendor scorecard, data rules matrix, oversight register, bias and quality log, incident log, training tracker, monthly metrics, committee decisions and a 25-measure dashboard
- 4 fillable PDF forms and 6 Word templates, including a full AI use policy with staff quick rules, a committee charter with board report, 35 messages and 31 AI prompts
- A Start Here map, a risk tier calculator, 3 cheat sheets including dated law and standards notes by country, a 34-event build calendar and a 34-task CSV board
The AI Use Policy and Governance Kit · Bodhih Pro Kits · 191 by Bodhih Training, trainers to 2,000+ companies since 2008.
How do I set up AI governance in a small or mid-size company?
Name an AI owner and a small committee, list every AI tool and feature in use, grade each use case by risk, set data rules by tool type, route new ideas through one intake form, assess vendors, design human oversight for higher tiers, train staff, and log incidents. The AI Use Policy and Governance Kit from Bodhih Training gives you a file for each step.
Want the full free guide first? Read How to Create an AI Governance Framework for a Small Company.
You already feel the problem. Here is what it is costing you.
A policy nobody can act on
Your AI policy says 'use AI responsibly'. Nobody disagrees, and nobody can tell from it whether customer emails may go into a chatbot, who approves a new tool, or what to do when something goes wrong.
More AI than you think
AI is now inside the help desk, the CRM, the recruitment software and the meeting tool, often switched on by default. Add free tools on personal accounts and the real list is far longer than the one IT holds.
Every request treated the same
Without risk tiers, either everything needs a committee and people stop asking, or nothing does and a bot ends up deciding about customers or staff with no one checking.
Vendor terms nobody has read
Whether a tool trains on your data, how long it keeps it and where it stores it are all in the terms. Few people read them before the first upload.
Laws arriving on several fronts
The EU AI Act, US state laws on automated decisions, India's data protection rules and regulators' guidance elsewhere all reach AI use, on different dates. Keeping track is a job in itself.
No answer for the board
The board asks whether AI is under control and what it delivers. The answer lives in emails and memories, not in a register you can show.
Picture the next few weeks with the kit open beside you.
Picture the first Monday. You open the Start Here map, type your company name, AI owner and thresholds on the Settings sheet, and send the first committee invitation from the message library. By lunchtime the inventory survey is with every member of staff, with a plain promise of no blame.
Now it is week four. When the support lead asks to switch on the AI reply feature in your help desk, you score it in the calculator, see Tier 2, check the data rules matrix and run the vendor questionnaire. The answer goes back in two working days with three clear conditions, and the Use-Case Register sets the review date for you.
Imagine the day something goes wrong. A colleague reports, within the hour, that customer data went into a free tool. You open the incident form, classify severity, send the deletion request and the customer notice from the library, and bring a root cause to the committee that fixes the system rather than blaming the person.
And then the quarterly board meeting. Someone asks whether AI is under control. You open the dashboard: tools inventoried, use cases by tier, overdue reviews, incidents, staff trained. Whether you start with the e-book tonight or the inventory survey tomorrow morning, the programme is already taking shape.
19 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The AI Use Policy and Governance Kit (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: the AI governance map
Two pages: the programme as ten building blocks with the file to open at each, your first hour, and a 30/60/90 day use plan.
AI Governance Workbook
15-sheet workbook: settings, scoring criteria, risk tiers, AI inventory, use-case register with automatic tiering, vendor scorecard, data rules matrix, oversight register, bias and quality log, incident log, training tracker, monthly metrics, committee decisions and a dashboard with a use-cases-by-tier chart.
AI Use-Case Risk Tier Calculator
Six-sheet calculator: score one use case on five criteria with two overrides and read the tier, approver, oversight, disclosure and review interval; score up to twenty at once on the Batch sheet with a tier chart.
AI use-case intake and record card
Three-page fillable form: the intake request with five tier scores and proposed controls, the AI owner's review and approval, and the one-page use-case record card (a plain-words model card) that answers an auditor's or customer's question in two minutes.
AI risk assessment and human oversight plan
Three-page fillable form for Tier 3 and 4 use cases: impacts by group and what could go wrong, controls and fairness checks, and the oversight design with a named reviewer, sample, escalation and stop rule, plus the DPIA and legal check prompts.
Vendor AI assessment questionnaire
Three-page fillable questionnaire: eight assessment areas to send to a vendor or answer from its published terms, scored 0 to 3 for the Vendor Assessment sheet, and a plain-words contract clause checklist to take to your counsel.
AI incident report form
Two-page fillable form: report within one working day without blame, classify severity, contain, assess for a data breach, communicate, find the root cause and record the lesson. Log a summary on the Incident Log.
AI use policy template with staff quick rules
Full AI use policy in nine sections: purpose and scope, six commitments, roles, data rules, the approved tools list, use-case intake and tiers, output review and disclosure, incidents and training, plus a one-page annex of ten quick rules for staff.
AI governance charter, committee terms of reference and board report template
A one-page charter the company can adopt (purpose, scope, commitments, decision rights by tier), the committee's terms of reference (membership, quorum, agenda, records, escalation), and a one-page quarterly board report template that copies its numbers from the workbook dashboard.
AI literacy training outline pack
Three session outlines with timings, activities and a short quiz: all staff (60 minutes), managers (90 minutes) and builders and power users (half day), plus a ten-question quiz and a facilitator's checklist.
AI governance message and script library
35 messages and scripts for every moment of the programme: launch, inventory survey, approvals and rejections, vendor requests and deletion demands, oversight reminders, training, committee agendas, incident notices, customer and supplier notifications, a public AI transparency statement, chatbot scripts, content labels and notices to candidates and staff.
Worked example pack: Fennel & Oak
One fictional 100-person company's programme shown completed: the inventory in brief, the website support chatbot use case through intake, risk assessment, oversight plan and committee decision, and the refund-email drafting-tool incident from report to lessons learned.
AI prompt pack for AI governance
31 tool-agnostic prompts grouped by the ten building blocks of the programme, each with what to paste in and what to check before you use the output.
AI risk tier, data rules and oversight decision card
Printable card: the four tiers at a glance with overrides, the data rules matrix, eleven if-then decisions and the four oversight questions.
AI governance mistakes to avoid
Twelve programme mistakes with the fix and the file to open, five generative AI output mistakes and three agent mistakes, with the research behind the urgency.
AI law and standards notes by country (correct at October 2026)
Dated cheat sheet: EU AI Act dates after the 2026 amendments, data protection and AI rules for the UK, India, US states, Singapore, Australia, Africa and the Gulf, and the OECD, NIST and ISO frameworks in plain words.
10-week AI governance build calendar with quarterly reviews
34 calendar events: the ten-week build from naming the AI owner to the first board report, then quarterly reviews and the annual review, each naming the file to open. Import into a new calendar and move to your dates.
AI governance task board import
34 build and review tasks as a CSV ready to import into Trello, Asana, Notion, Planner or Jira, with week, owner, file to open and due date.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 19 files plus a one-click ZIP
- E-book
- 61 pages
- Workbooks
- 15-sheet governance workbook and 6-sheet risk tier calculator, with sample data, formulas and a dashboard
- Works with
- Excel, Google Sheets, LibreOffice, Word, Google Docs, Acrobat Reader, GoodNotes, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Notion, Planner, Jira
- Best for
- Companies of roughly 20 to 1,000 people that use AI tools or build AI into products or processes, in any country
One Page Is Not a Programme
Why a one-page AI policy is not enough, and the ten building blocks of a working programme.
Principles You Can Actually Apply
Six testable commitments informed by the OECD AI principles, each creating a job elsewhere in the programme.
Who Owns It: The AI Owner, the Committee and the Three Lines
An AI owner with time, a small recorded committee, decision rights by tier and the three lines model.
Find It All: The AI Inventory
Survey, scan, verify and record every AI tool, feature, in-house build and agent, and handle shadow AI kindly.
Risk Tiers: From Drafting an Email to Deciding About People
Five scored criteria, four tiers and two overrides that set approval, oversight and review frequency.
Acceptable Use: What Data Goes Where
A data rules matrix by data class and tool category, the approved tools list, output review rules and leakage routes.
Intake and Review: Saying Yes Well
One intake form, a two-day fast lane for low tiers, full review for high tiers and a one-page record card.
Vendors and Building: Assessing Tools and Deciding Build vs Buy
An eight-area weighted vendor scorecard, a contract clause checklist and the questions to ask before building.
Human Oversight, Fairness and Decisions About People
Oversight modes by tier, plain-words fairness checks, generative AI quality controls and copyright basics.
Transparency, Monitoring and Incidents
Disclosure to customers, staff and the public, ten minutes a month on metrics, and a seven-step incident process.
Literacy, Metrics, the Board and Agents
AI literacy training by role, a one-page board report, rules for agents, and how practice differs by country.
The Programme You Now Run
The ten-week build in brief and the small monthly routine that keeps the programme alive.
AI Governance Terms in Plain Words
Plain definitions for eleven governance terms, each linked to where it appears in the kit.
Using AI to Help Govern AI
Six rules for the AI owner and a prompt that summarises a vendor's AI terms against the eight areas.
Not just reading. Tools you will actually open again.
E-book
- The AI Use Policy and Governance Kit: 10 chapters, 2 appendices and 6 hand-drawn figures (PDF)
Start here
- 00-Start-Here-AI-Governance-Map: the ten building blocks with the file to open at each, your first hour and a 30/60/90 day use plan
Spreadsheets
- AI Governance Workbook (15 sheets): Start here, Settings, Criteria, Risk Tiers, AI Inventory, Use-Case Register, Vendor Assessment, Data Rules Matrix, Oversight Register, Bias and Quality Log, Incident Log, Training Tracker, Monitoring Metrics, Committee Decisions and a Dashboard with 25 live measures and a tier chart
- AI Use-Case Risk Tier Calculator (6 sheets): score one use case or many at once, see the tier, approver, oversight and review interval
Fillable PDF forms
- AI use-case intake and record card: intake, review and approval, and a one-page record card (3 pages)
- AI risk assessment and human oversight plan: impacts, fairness, quality and legal checks, and the oversight design (3 pages)
- Vendor AI assessment questionnaire: eight assessment areas and a 14-point contract clause checklist (3 pages)
- AI incident report form: report, severity, containment, breach check, communication, cause and lesson (2 pages)
Word templates
- AI use policy template with an approved tools section and a one-page annex of ten quick rules for staff
- AI governance charter, committee terms of reference and one-page quarterly board report template
- AI literacy training outline pack: all staff 60 minutes, managers 90 minutes, builders half a day, a ten-question quiz and a facilitator's checklist
- AI governance message and script library: 35 messages, from programme launch and tool decisions to incident notices and customer disclosures, including a public AI transparency statement
- Worked example pack: one composite 100-person retailer's inventory, a customer-support chatbot review and a data incident, with the forms completed
- AI prompt pack for AI governance: 31 prompts grouped by building block, each with what to paste in and what to check
Cheat sheets
- AI risk tier, data rules and oversight decision card, with if-this-then-that moments
- AI governance mistakes to avoid: twelve mistakes and what to do instead
- AI law and standards notes by country, correct at October 2026: EU AI Act timelines, GDPR and UK GDPR, India DPDP, US state laws, Singapore, Australia and more
Calendar and import
- 10-week AI governance build calendar with quarterly reviews (ICS): 34 events for Google Calendar, Outlook or Apple Calendar
- AI governance task board import (CSV): 34 tasks for Trello, Asana, Notion, Planner or Jira
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Write AI principles as testable commitments and an AI use policy that staff can follow
- Set up an AI owner, a small committee and decision rights by risk tier
- Build and keep current an inventory of AI tools, features inside existing software, in-house builds and agents
- Grade any AI use case into one of four risk tiers with clear approval and oversight rules
- Publish data rules that say which data may go into which kind of tool
- Run use-case intake with a two-day fast lane and a full review for higher-risk uses
- Assess AI vendors on eight areas and know which contract clauses to ask counsel about
- Design human oversight, run plain-words fairness checks, handle AI incidents and report to the board quarterly
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Signing It Off: AI Governance Judgment
Take the assessment →AssessAll assessmentEveryday AI Judgment at Work
Take the assessment →AssessAll assessmentAI Draft Supervision: Reviewing What the Machine Wrote
Take the assessment →JobularyHow a Jobulary development plan works
Make it a growth plan →A taste of Chapter 9
Customers. A customer-facing bot introduces itself as automated at the start of every conversation and offers a route to a person. AI-generated content is labelled where a reasonable person would want to know: a product description drafted by AI and checked by a person may not need a label; a "customer review summary", an image of a product that does not exist yet, or content about health, money or safety does. The EU AI Act's transparency duties and several national laws make parts of this a legal requirement; see the dated sheet. Staff. Tell staff, in plain words, which AI tools are used in decisions about them before those tools are used. Many laws require it; good practice requires it everywhere. The public. A short AI transparency statement on your website says what you use AI for, what you do not use it for, how you oversee it, and how to reach a human. The message library includes a template (message 29).
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Policy | One page that says 'use AI responsibly' | A full policy with testable commitments, data rules, an approved tools list and ten quick rules for staff |
| Knowing what is in use | The list IT happens to hold | A no-blame survey, IT and finance scans, and an inventory that includes features inside existing software and agents |
| Approving new uses | Every request to one busy person, or none at all | Five-criteria risk tiers, a two-day fast lane and a committee for the uses that affect people |
| Vendors | Click accept on the terms | Eight-area weighted scorecard and a 14-point contract clause checklist to take to counsel |
| Human oversight | 'A human is in the loop' | A named reviewer, sample rate, stop rule and check date on an oversight register |
| When things go wrong | Find someone to blame | A seven-step incident process, a data breach check, message templates and a root-cause fix |
| Law and standards | Not mentioned, or one country only | Plain-words notes on the EU AI Act, GDPR, US state laws, India, Singapore and more, dated October 2026 |
Made for you if…
- Compliance officers and risk owners who have been handed AI as a new risk area
- Data protection leads and DPOs who need AI rules that staff can actually follow
- IT and security managers who own tool approvals, access and vendor checks
- HR and office managers who own policies, training and decisions about people
- Founders and COOs of companies of roughly 20 to 1,000 people using AI tools or building AI into products
- Teams working across countries, including India, the UK, the EU, the US, the Gulf, Singapore, Africa and Australia
Probably not for you if…
- Anyone looking for a legal opinion or a certification: the kit is educational, keeps laws in one sheet dated October 2026, and asks you to check your regulator, counsel and local law
- Readers who only want a short handbook policy: The Employee Handbook and Policy Builder covers one-page policies; this kit builds the whole programme
- Developers securing AI-built apps: Ship It Safely covers that; this kit governs how the company decides about AI
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
AI is already in your company. Give it a programme, not just a policy.
Open the Start Here map, type your settings into the workbook and send the inventory survey this week. Whether you begin with the e-book this evening or the committee invitation tomorrow morning, the first hour is already planned.
Personal licence for the buyer's own use (and use with your own team or clients where the kit says so). Please don't share or resell the files. Team and company licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The Data Privacy Compliance Starter
Set up a privacy programme for a small or mid-size company.
The Harassment Prevention Programme Kit
Build a respectful workplace programme.
The Business Continuity and Crisis Plan
Be ready for the bad day.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The AI Use Policy and Governance Kit: FAQs
Read the free guideAlready bought? Resend my linkWhat should an AI use policy for employees include?
Purpose and scope, a short set of commitments, roles, data rules that say which data may go into which kind of tool, an approved tools list, how to request a new use, how outputs are reviewed and disclosed, how to report mistakes, and training. The kit's policy template covers each section and adds a one-page annex of ten quick rules for staff.
How do I set up an AI governance committee?
Keep it small: a chair with authority, the AI owner, and leads for security, HR, finance and one business area, meeting for about 45 minutes a month with decisions recorded. Write decision rights by risk tier into a one-page charter. The charter and terms of reference template in the kit are ready to adapt.
How do you classify AI use cases by risk?
Score each use case on data sensitivity, impact on people, autonomy, scale and reversibility, then map the total to a tier. Anything that shapes a decision about a person's job, pay, credit or rights goes to a high tier whatever the score. The risk tier calculator does the arithmetic and shows the approver and oversight for each tier.
What data can staff put into AI tools like ChatGPT, Gemini, Claude or Copilot?
It depends on the data class and the tool's terms. A common approach is that public and internal data may go into approved tools, personal and confidential data only into approved enterprise tools under an approved use case, and secrets and sensitive personal data only with specific approval. The data rules matrix and decision card set this out for your company to adapt.
Does this kit make us compliant with the EU AI Act or certified to ISO/IEC 42001?
No. The kit is educational and helps you organise a programme. It describes the EU AI Act, NIST AI RMF and ISO/IEC 42001 ideas in plain words, keeps legal specifics in a sheet dated October 2026, and asks you to check your regulator, counsel and local law before relying on anything with legal weight.
How should we govern AI agents that take actions?
Treat every agent as at least medium risk, write down what it may do alone, what needs approval and what it may never do, give it the least access it needs with its own credentials, log its actions, set limits and a kill switch, and test it before it touches real systems. Chapter 10 and the record card cover this.
How do I measure my own starting point in AI governance judgment?
AssessAll offers three assessments that match this kit: Signing It Off: AI Governance Judgment for approvers, Everyday AI Judgment at Work for all staff, and AI Draft Supervision: Reviewing What the Machine Wrote for anyone who reviews outputs. Links are on the Start Here map; they are separate products and not included in the kit.
How do I turn this into a development plan for the people running the programme?
Pick one or two skills from the kit, such as risk tiering or oversight design, for each committee member or reviewer to practise, then build them into a plan. Jobulary explains how its development plans work, and the link is on the Start Here map.
We only have a few people. Is this too much?
The programme is sized for small and mid-size companies. Once built, the routine is ten minutes a month on metrics, a 45-minute committee meeting and quick answers on new requests. The 10-week calendar spreads the build into weekly steps.
Which software do I need?
The workbooks open in Excel, Google Sheets or LibreOffice and use no macros. The forms are fillable in Acrobat Reader and most PDF apps, the templates open in Word or Google Docs, the calendar imports into Google Calendar, Outlook or Apple Calendar, and the CSV imports into Trello, Asana, Notion, Planner or Jira.
What is the refund policy?
Digital kits are non-refundable once downloaded. The exceptions are corrupted files that are not fixed within 3 working days, duplicate charges, or failed delivery.
How much does The AI Use Policy and Governance Kit cost?
₹999 including 18% GST for buyers in India, or $29 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
