Free template
AI policy template for portfolio companies
An AI policy for a portfolio company should fit on one page and answer five questions: which AI tools staff may use, what information may go into them, when a person must review the output, who approves new tools, and who owns the policy. The template below is written for the non-technical teams at portcos (sales, service, finance and operations), so an operating partner can roll one policy out across a portfolio and let each company fill in its own tools.
Why portcos need one now
Teams are using AI with or without a policy. In Liberty Mutual's 2026 Independent Agency Growth Study of 1,149 agency principals and staff, 65% said they had used AI for work in the past year, but only 18% said their agency had a well-defined AI policy, and only 29% of principals said they knew enough to make decisions about AI.
A policy doesn't slow that use down. It moves it into accounts the company controls and sets a few rules people can remember.
How to roll it out across a portfolio
- Start with one template for every portco. Keep the structure identical so the operating partner can compare companies, and let each company fill in its own approved tools and examples.
- Name an owner at each company. One person, usually whoever runs operations, keeps the tool list current.
- Train people on it while you set up their tools. Walk each team through the rules in the same session where their AI accounts and workflows are set up.
- Have everyone sign it, then review it every six months, or whenever the approved tools change.
The template
Copy the text below, or get the editable Word version underneath it. Replace everything in [brackets].
[Company] AI acceptable-use policy
Effective: [date] · Owner: [name, title] · Next review: [date]
1. Purpose
This policy lets our team use AI tools to save time on everyday work while protecting client information, our reputation and the quality of our work.
2. Who it covers
Everyone who does work for [Company], including employees, contractors and temporary staff, on any device.
3. Approved tools
Use only these AI tools for company work, signed in with your company account:
- [AI assistant, business plan]
- [AI features inside our core systems, for example our agency management system, CRM or ERP]
Personal and free AI accounts may not be used for company work. To request a new tool, ask [owner]. A tool can be approved only if [Company] controls the accounts and the vendor's terms say our data is not used to train its models.
4. What information can go into AI tools
| Type of information | Examples | Rule |
|---|---|---|
| Public | Published website copy, general industry questions, blank templates | Any approved tool |
| Internal | Internal processes, drafts, non-client figures | Approved company tools only |
| Client and personal | Client names with account or policy details, employee records | Only tools [owner] has approved for client data, and only what the task needs |
| Never | Passwords, Social Security numbers, full bank or card numbers, health information | Never, unless [owner] approves a specific tool for that data in writing |
5. A person reviews anything that leaves the company
AI drafts; people decide. Anything AI produces that goes to a client, carrier, partner or regulator, or that commits [Company] to something (a quote, coverage description, contract term, price or financial figure), must be reviewed by a person before it is sent. The person who sends it is responsible for it.
6. Check facts
AI tools can state wrong facts with confidence. Check names, numbers, dates and coverage or contract details against the source system before you use them.
7. Decisions about people stay with people
Don't use AI to make or recommend decisions about hiring, firing, pay, client-specific pricing or eligibility without approval from [owner].
8. Tell people when they are talking to a machine
If a client is talking to an automated assistant with no person in the loop, tell them.
9. Accounts and connections
Use your own company account, with [single sign-on / two-factor authentication]. Don't share accounts. Don't connect an AI tool to company email, files or systems unless [owner] has approved that connection.
10. Recording calls
Ask before using an AI note-taker on a call with anyone outside [Company], and follow the call-recording consent rules that apply in your state.
11. Report problems the same day
If information went into the wrong tool, or AI output with a mistake reached a client, tell [owner] the same day. Reporting quickly won't be held against you.
12. Training
Complete [Company]'s AI training before using approved tools for client work.
13. Ownership
[Owner] maintains this policy and the approved-tool list and reviews both every six months, or sooner if our tools change.
Acknowledgment: I have read this policy and will follow it. Name, signature, date.
Get the editable Word version
Fill in four fields and download the template as a Word document, ready for your company name, tools and owner.
Adapting it by industry
| Industry | What to add |
|---|---|
| Independent insurance agencies | List your agency management system's AI features (for example in Applied Epic or AMS360) as approved tools. Check carrier agreements for limits on sharing policyholder data, and keep coverage advice with licensed staff. |
| Architecture and engineering firms | Check client contracts for confidentiality terms that limit outside tools before project data goes into proposals. |
| Staffing firms | Treat candidate records (résumés, background checks, IDs) as client and personal data. Some cities and states regulate AI used in hiring decisions, for example New York City's Local Law 144. |
| Wholesale distributors | Treat customer-specific pricing and margins as internal information, and check customer contracts before sharing them with any outside tool. |
For the rest of the rollout, see how to roll out AI across portfolio companies and how to keep client data safe when portcos use AI.
This template is a practical starting point, not legal advice. Have counsel review it before adopting it, especially if your companies handle regulated data.
Questions
Does a small portfolio company need an AI policy?
Yes. Staff are already using AI at work whether or not there is a policy, so the choice is between written rules and no rules. One page is enough for most portcos: approved tools, what data can go into them, when a person must review the output, and who owns the policy.
Who should own the AI policy at a portco?
One named leader at the company, usually the person who runs operations, with help from whoever manages IT. The owner keeps the approved-tool list current and reviews the policy every six months.
Should portcos ban free AI tools?
For company work, yes. Business plans give the company admin control over accounts and contract terms about how its data is used. Personal and free accounts give the company neither.
Is this template legal advice?
No. It is a practical starting point. Have counsel review it before adopting it, especially if the company handles regulated data such as health, financial or candidate records.