Does your company have rules for how AI is used? Get your AI policy written – free.
Your people already use ChatGPT, Copilot and other AI tools – often without rules. Since February 2025 the EU AI Act also expects companies to take measures to support their staff's AI literacy. Answer questions about how you use AI and you get a ready AI policy and AI governance framework, plus two more governance documents, written for your company.
An AI policy and three governance documents, written for youFree
Rules for your people, a framework for who decides on AI, a checklist for AI vendors and a risk assessment template – with your company name, owners and tools filled in.
A picture of where you stand today
Ten areas, from how your people use AI to security and vendors, assessed from your answers. You see straight away where the gaps are.
Word files you own
Change anything and approve them through your usual process. An appendix shows which answer shaped which wording.
2 Aug 2026Transparency duties (Art. 50) and the rest of the Act; fines for general-purpose AI providers
2 Dec 2026New prohibition (non-consensual intimate images); AI-content marking for existing generative AI
1
Step 1: Answer the questions
Questions about how you use AI today: tools, data, people and vendors. You can save and share a link, so IT, HR and whoever owns data protection can answer their parts.
About 40 minutes
2
Step 2: The documents are written instantly
You get four documents written from your answers and a picture of where you stand today, across ten areas.
When you send
3
Step 3: Review and approve
Change what you want and approve the documents as usual. If you want to go through the result, we are happy to call you.
Word files you own
Reviewed by Fredrik Karlsson, Group COO & CISO, Opsio. Last reviewed .
AI platforms we govern, secure and implement
Claude
ChatGPT
Copilot, Azure AI
Gemini, Vertex AI
Bedrock
AI is already used in your company – but who set the rules?
This is not about building AI. It is enough that your people use it. Three reasons to deal with it now:
People use AI without rules
Personal ChatGPT accounts, browser extensions and AI features in services you already pay for. Without rules, customer data and business secrets can end up in tools you have no view of – and it often only shows when a customer or an incident forces the question.
Solved with: Acceptable Use Policy, Approved AI Tools Register
The legal requirement already applies
Since 2 February 2025 the EU AI Act expects companies that use AI to take measures to support their staff's AI literacy. A written AI policy your people know is the simplest way to show you have taken that duty seriously. Customers and tenders are starting to ask for it too.
Solved with: Acceptable Use Policy, AI Governance Framework
AI that acts on its own
AI tools with access to email, ticketing systems or cloud environments can do things nobody approved. You need to know who may switch them on, what they may do and how they are stopped.
Solved with: Risk Assessment Template, Acceptable Use Policy
Written for the duties that already apply.
Regulation (EU) 2024/1689 applies to anyone placing AI on the EU market or using its output in the EU, wherever they are established. Its prohibitions and its AI literacy duty have applied since February 2025; the general-purpose AI and governance provisions since August 2025. The high-risk timetable was moved by the Digital Omnibus to December 2027 and August 2028.
The four documents are written against those duties, and against GDPR wherever personal data is involved, because every AI system that touches personal data is a GDPR system first.
Stated plainly
The documents are an initial draft prepared from your self-assessment. They are not a legal opinion, a certification, a security audit or a DPIA, and each one says so. What they give you is the written governance the Act assumes exists, in your organisation's name, ready for review.
Article 4AI literacy for everyone who operates or uses AI
Article 5prohibited practices, written into the Acceptable Use Policy
Articles 25 and 26provider and deployer responsibilities, in the Vendor Checklist and the Framework
EU AI Act timeline: what applies whenSource: Regulation (EU) 2024/1689 on EUR-Lex, as amended by the Digital Omnibus (in force 27 July 2026). Last checked 12 October 2026.
Date
What applies
1 Aug 2024
In force
2 Feb 2025
Prohibited practices and AI literacy duty apply
2 Aug 2025
General-purpose AI model obligations; governance and penalties
2 Aug 2026
Transparency duties (Art. 50) and the rest of the Act; fines for general-purpose AI providers
2 Dec 2026
New prohibition (non-consensual intimate images); AI-content marking for existing generative AI
2 Dec 2027
High-risk obligations for Annex III systems (was 2 Aug 2026)
2 Aug 2028
High-risk AI in regulated products, Annex I (was 2 Aug 2027)
An AI policy and three governance documents. Written for your company – not a blank template.
The rules for your people, the framework for who decides on AI, the review of AI vendors and the risk assessment for each AI service you introduce. Together they give you something concrete to show when customers, tenders or regulators ask – and a way to actually govern how AI is used.
[Organisation]
AI Governance Framework
Owner: [Executive AI owner]
1.Purpose and scope
2.AI governance model
3.Enterprise AI governance
4.AI risk, data and security
5.Appendices A–E
Written for you≈ 50 pages
Word, editable, free
AI Governance Framework
The document everything else hangs off.
Who is accountable for AI, how a use case moves from idea to operation, how risk is classified, how information may be used, and which tools are approved.
When due diligence is required, set from your procurement answer
Schedule 1 pre-lists every provider you declared as the first assessments to run
Your regulatory position in the legal section
Owner and custodian named
Every file ends with a schedule that lists the answer behind each tailored clause.
[Organisation]
AI Risk Assessment Template
Owner: [Executive AI owner]
1.Basic information
2.Personal data and privacy
3.EU AI Act mapping
4.Risk classification
5.Approval
Written for you≈ 45 pages
Word, editable, free
AI Risk Assessment Template
One assessment per AI use case, mapped to the Act.
The structured record that decides whether a use case may proceed: purpose, data, privacy, agents, oversight, legal mapping, security, classification, controls, approval, review.
The documents are free. Making them work is our job.
Opsio is a Swedish cloud and AI company, founded in 2018 in Karlstad, with four offices in India and round-the-clock operations. We build, run and secure cloud and AI environments for companies in Europe and Asia – and the documents follow the same principles we work by for our own customers.
AI compliance
The EU AI Act and GDPR in practice: an inventory of AI use, risk and impact assessments, controls and evidence your auditor can check.
Start free: the documents are yours, whether or not we work together.
If you want help closing the gaps the assessment shows, we are here – policy, technology and operations.
The EU AI Act's dates are still moving. We help you keep the documents current.
Johan Carlsson
Country Manager, Sweden
“Answer the questions and see where you stand. If you then want to talk the result through, call me. We are happy to go through it together and work out a sensible next step for you.”
Yes. The questions, the assessment and the four documents are free, with no card and no obligation. We offer it because many companies then want help putting in place what the documents describe – that is a separate engagement you are free to decline. The documents are yours either way.
Who is this for?
Companies that use AI tools at work, even if you do not build your own AI. It suits management who want order in responsibility and risk, and the IT manager who needs rules for which tools may be used and how. The answers can be split between IT, HR and whoever owns data protection.
How tailored are the documents?
They are written from your answers: your company name, your owners, your tools and vendors, and the parts of the business where you use AI. Sections that do not apply to you, such as AI in HR, are marked out of scope. An appendix in each file shows which answer shaped which wording.
What format are they in, and can we edit them?
Editable Word documents, one at a time or all in a zip file. Change any clause, put your own branding on them and take them through your own approval. No licences.
Is this only about the EU AI Act?
No. The documents start from the EU AI Act, and where AI touches personal data they are written for GDPR too.
Can we adopt them as-is?
The AI policy and the framework are written to be adopted with small edits, and the two templates can be used as they stand. Where a clause depends on a question you answered 'don't know', the appendix says so – fix that before you approve the document.
Is this legal advice, or a certification?
No. The documents are a first draft from your own assessment. They are not a legal opinion, a certification, a security audit or a privacy impact assessment, and each one says so. Have whoever owns legal, data protection and information security review them before you approve them.
How long does it take?
About 40 minutes if one person has the answers. It usually takes longer in the calendar because several people contribute – that is why you can save and share a link.
Who sees what we submit?
The Opsio consultants who review assessments. No AI model reads your answers: the assessment and the documents come from Opsio's own rules and templates. Your answers are processed in Frankfurt and stored in Frankfurt and Stockholm; only your name, contact details, company size and location and the result go to our CRM and email provider so we can follow up. We never sell your answers or use them for advertising, and you can ask us to delete them at any time at info@opsio.se. Documents you attach can be provided under NDA instead.
In depth: the EU AI Act, the documents in detail and the ten areasTimeline and articles, the documents compared, a sample text, what the assessment looks at and the maturity levels.
The first lines of the generated policy, word for word. Your organisation's name, the owner you named and your approved tools are written in where the brackets are.
[Your organisation] – AI Acceptable Use Standard
Version 1.0
Owner: [named from your answers]
Parent document: [Your organisation] AI Governance Framework
Review: annual, or on material legal, regulatory, technological or business change
Purpose
The purpose of this AI Acceptable Use Standard is to establish clear and practical requirements for the day-to-day use of AI by employees, contractors and other authorised users acting on behalf of [Your organisation].
The Standard is intended to enable responsible AI adoption without unnecessarily restricting legitimate business use.
Core rules for AI use
AI shall be used only where there is a legitimate business purpose. Users shall not introduce AI into a business process merely because an AI capability is available.
Users shall use only AI tools that have been approved by [Your organisation] for business use. The current Approved AI Tools Register is maintained as Appendix E to the AI Governance Framework.
AI governance, answered.
What is an AI governance framework?
An AI governance framework is the controlling document for how an organisation uses AI. It names who is accountable, sets how a new AI use case is assessed, classified and approved, defines which information may be used and which tools are approved, and is where an EU AI Act deployer shows how it meets its AI literacy and risk duties.
What should an AI acceptable use policy include?
An AI acceptable use policy tells staff which AI tools and accounts they may use, what they must never enter, such as personal data, customer confidential information or credentials, how to check AI output before relying on it, which uses are prohibited, and how to report an AI incident. It is also a practical way to evidence the EU AI Act's Article 4 literacy duty.
What does the EU AI Act require of organisations that use AI today?
Since 2 February 2025 organisations using AI in the EU must not use prohibited AI practices (Article 5) and must take measures to support their staff's AI literacy (Article 4, as amended by the Digital Omnibus). Transparency duties such as telling people they are talking to an AI apply from 2 August 2026 (Article 50). Deployer duties for high-risk Annex III systems apply from 2 December 2027.
What is an AI readiness assessment?
An AI readiness assessment measures how far an organisation's governance of AI has come: ownership, policies, risk process, privacy, security, vendors and agents. Opsio's free assessment scores ten domains on a five-level maturity scale from your answers and writes the four governance documents those answers call for.
Is there a free AI policy template?
Yes. The AI Acceptable Use Policy is the AI policy staff follow day to day, and Opsio's assessment writes it for free from your answers instead of handing you a blank template: approved tools, what must never be entered, how to check output, prohibited uses and how to report an incident, with your organisation and owners named.
How does this relate to ISO 42001 (ISO/IEC 42001)?
ISO/IEC 42001 is the international standard for an AI management system. The AI Governance Framework is written having regard to ISO/IEC 42001, alongside ISO/IEC 27001, ISO/IEC 23894 and the NIST AI RMF, so its roles, risk process and approved-tools register are a practical starting point. It is not a certification: an ISO/IEC 42001 certificate needs an audit by an accredited certification body.
Ten domains. One score.
Each domain is scored on its own checks and tells the documents what to write. A domain that does not apply to you, because you have no agents or no AI in HR, is left out of the score, and the matching section is marked out of scope rather than written as if it applied.
Domain 01 of 10
AI governance
Ownership, committee, roles, register, strategy, periodic review and change control.
Documents you receive for this domain
AI Governance Framework
What the assessment checks
Governance framework
Designated owner and RACI
AI register
Review and change triggers
Domain 02 of 10
Acceptable use
What employees may put into which tools, personal accounts, output verification and shadow AI.
Documents you receive for this domain
AI Acceptable Use Policy
AI Governance Framework
What the assessment checks
Acceptable use policy
Approved tools
Personal account rules
Output verification
Domain 03 of 10
Risk management
Whether AI is assessed and classified before it is switched on, and who approves it.
Documents you receive for this domain
AI Risk Assessment Template
AI Governance Framework
What the assessment checks
Risk methodology
Risk classification
Approval process
Monitoring and continuity
Domain 04 of 10
Privacy
Personal and special-category data in AI, DPIAs, automated decisions and transparency.
Documents you receive for this domain
AI Risk Assessment Template
AI Acceptable Use Policy
What the assessment checks
DPIA process
Automated decision-making
Minimisation controls
Privacy notices
Domain 05 of 10
Information security
The controls between AI systems and your data, and whether AI-specific threats are on the list.
Documents you receive for this domain
AI Governance Framework
AI Acceptable Use Policy
What the assessment checks
Security baseline
AI threat assessment
Access and logging
Data-loss prevention
Domain 06 of 10
Third-party AI
Vendor due diligence, contracts, inventories, training-on-your-data clauses and exit.
Documents you receive for this domain
AI Vendor Due Diligence Checklist
What the assessment checks
Vendor due diligence
Procurement gate
Contract clauses
Vendor inventory
Domain 07 of 10
Engineering & development
AI-assisted coding, internal model development, testing, deployment and drift.
Documents you receive for this domain
AI Acceptable Use Policy
AI Risk Assessment Template
What the assessment checks
Development standard
Coding policy
Testing and validation
Deployment controls
Domain 08 of 10
HR
AI in recruitment, performance, monitoring and employment decisions, with human review.
Documents you receive for this domain
AI Acceptable Use Policy
AI Risk Assessment Template
What the assessment checks
Employee AI policy
Recruitment rules
Monitoring requirements
Human review
Domain 09 of 10
Customer & product AI
AI in what you sell: terms, disclosure, approval, contractual clauses and product governance.
Documents you receive for this domain
AI Vendor Due Diligence Checklist
AI Acceptable Use Policy
What the assessment checks
Customer AI terms
Disclosure
Contract clauses
Product governance
Domain 10 of 10
AI agents & automation
Agents with system access: permissions, human approval, logging, production limits, kill-switch.
Documents you receive for this domain
AI Acceptable Use Policy
AI Risk Assessment Template
What the assessment checks
Agent standard
Access controls
Human approval
Emergency shutdown
Five levels, from informal to measured and improved.
The questionnaire asks where you would put yourself. The score says where the answers put you. The four documents are what takes an organisation to Level 3 on paper.
Level 1
Initial
AI is being used, but governance is largely informal.
Level 2
Developing
Some AI policies, controls or assessments exist, but governance is not consistent across the organisation.
Level 3
Defined
AI governance responsibilities, policies and risk processes are formally established.
Level 4
Managed
AI governance is integrated with privacy, security, procurement, risk and technology processes.
Level 5
Mature
AI governance is continuously monitored, measured and improved, and integrated into the broader risk and technology management framework.
Benchmark: where organisations score on AI readiness
Find out where you stand – and get your AI policy. Free.
AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist, AI Risk Assessment Template. About 40 minutes, four Word files you own – whether or not we work together afterwards.
