An AI policy is the written set of rules an organisation sets for how its people and systems may use AI: which uses are allowed, which are banned, who approves new ones, what must be checked by a person, what is recorded, and what training each role needs. It is an instruction, not a statement of values.
Why does an AI policy matter when agents act?
Most early AI policies were written for people typing questions into a chat tool. They cover data you must not paste in and outputs you must check. Agents change the question from "what may staff ask AI?" to "what may AI do on our behalf, and who answers for it?" A policy that does not address agents leaves approval rights, limits and accountability to whoever set up the workspace.
The other gap is training. Many policies say staff "must be trained" without saying what training, how it is proved, or what happens when it lapses. A clause like that cannot be enforced, which is the point made in why your AI policy needs a training clause with teeth.
What does a working AI policy contain?
For an organisation running agents, the policy usually covers:
- Scope: which systems count as AI and which as agents.
- Permitted and prohibited uses, with reasons.
- Approval of new agents and new capabilities, and who signs off.
- Depth and approval rules: what an agent may do alone, what is held for a person, what is never allowed.
- Data rules by class of data.
- Competence: the credential each role needs, and that approval rights pause when it lapses.
- Records: what is filed and how long it is kept.
- Breaches and incidents: how to report, without blame.
A ready structure is in the AI agent policy template, and the drafting process in how to write an AI agent policy.
What is an example?
Take a lender whose policy says: "Agents may draft collections letters. A person with a current reviewer certificate must approve any letter that proposes a payment plan. If that certificate lapses, the person's approval rights are suspended until renewal shows on the issuer's verification page." That clause names the action, the depth, the person, the credential and the consequence. A reviewer, an auditor and the agent's owner can all read it the same way.
How is an AI policy different from an AI governance framework?
The framework is the whole system: principles, roles, inventory, risk assessment, assurance, reporting lines. The policy is one document inside it, the one staff are held to. A framework can exist without staff ever reading it; a policy only works if they do. Some organisations split it further, keeping a short AI literacy policy that sets the training standard for every role.
Which terms are related?
- Acceptable use policy: the staff-facing rules for individual use.
- Retake policy: what happens when someone fails an assessment, covered in what a retake policy is.
- AI governance framework: the structure the policy sits in.
The broader topic is AI literacy and certification for people who work with agents.
Where the Academy fits
Pryme Intelligence Academy gives a policy something checkable to point at. Certificates are issued through VerifyDoc.ai and show as current, lapsed or revoked at source, so a clause tying approval rights to a current certificate can be enforced. For teams, an admin view shows progress, results, certificates and expiry dates in one place.
Questions people ask
How often should an AI policy be reviewed?
At a fixed interval, and whenever an agent gains a new capability, a new data class is allowed or a rule changes. Version it, and record who approved each version.
Who should approve the AI policy?
The executive or board committee that owns risk, on the recommendation of the AI governance lead. Operations and compliance should review the parts they will apply every day.