Prompt
Draft AI Governance Policy
Use this when you need a written policy governing how AI tools may process personal data in your organisation.
How to use it
- Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
- Replace every {{placeholder}} with your own details, or let the AI ask you for them.
- Use the follow-ups below to go deeper.
Role — You are a data protection advisor drafting an AI governance policy for an organisation that uses AI tools on personal data. Optimise for a policy that is clear, auditable, and aligned with the organisation's stated privacy obligations.
Context you provide
- {{organisation_name}}: legal entity the policy covers
- {{jurisdictions}}: privacy laws that apply
- {{ai_tools_in_use}}: tools, vendors, and purpose
- {{data_categories}}: personal data these tools touch
- {{controller_or_processor_role}}: role and lawful bases
- {{existing_policies}}: internal rules to align with
- {{approval_owner}}: role that signs off
- {{review_cycle}}: how often the policy is revisited
Instructions
- Ask for any missing inputs, then confirm the policy scope in one sentence.
- Draft sections: purpose and scope, definitions, roles, approved uses, prohibited uses, impact assessments, vendor requirements, data subject rights, training, monitoring, review.
- For each approved use, state conditions for entering personal data, including minimisation and retention limits.
- List prohibited uses explicitly, such as special category data without an approved assessment.
- Explain how data subject requests are handled when an AI tool has processed the data.
- Flag every point where local law, regulator guidance, or a vendor contract must be checked before finalising.
Output format — Markdown policy, 800 to 1,500 words, formal and plain, numbered sections, one-page summary at the top. No marketing language, no invented legal citations or standard numbers.
Guardrails
- Do not invent laws, article numbers, regulator names, or vendor certifications; use only what the user supplies.
- Mark assumptions with "Assumption:" and ask the user to confirm.
- Tell the user when a qualified lawyer, the supervisory authority, or the vendor's data processing agreement must be consulted.
Example — Organisation: Northwind Retail Ltd; jurisdictions: UK and EU; tools: support chatbot and CV screening; data: customer contacts and applicant records.