An AI policy is a foundational governance document that defines how your organization uses, deploys, oversees, and is accountable for AI systems. Without one, every team that adopts an AI tool — including third-party generative AI platforms — does so according to their own judgment, creating inconsistent risk exposure that compounds over time. A well-written AI policy includes six core elements: scope and definitions, permitted and prohibited uses by risk level, named accountability and ownership, data handling requirements, human oversight requirements for high-risk outputs, and a vendor evaluation and review process.