The 9 policy sections

1. Purpose and scope — why this policy exists, who it applies to.

2. Approved AI tools — explicit list of approved tools + plan tier required.

3. Prohibited inputs — client PII, health, financial, source code, internal strategy.

4. Output review — human review required for client-facing output. No-review categories.

5. Data retention and training opt-out — Enterprise tiers and no-train settings required.

6. Attribution and disclosure — when to tell clients AI was used.

7. Training requirements — onboarding + quarterly refresh.

8. Incident response — what to do if PII gets into a prompt.

9. Policy ownership and revision — who owns this, when to update it.

Canadian-specific considerations

• PIPEDA implications: client data going to US-hosted AI tools requires consent + risk assessment.

• Provincial law: Quebec (Law 25) is stricter; AODA + Ontario healthcare have their own overlays.

• Crown corporation and government contractors have additional restrictions.

Talkerstein recommendation

Implement this BEFORE you discover an incident. The policy itself takes a half-day to draft, a week to adopt, and prevents the kind of incident that costs $10k-$100k in remediation + reputation.

Related

• AI Readiness Assessment

• Talkerstein AI Implementation service

Workshop the policy with your team

90 minutes. We customize the template, train the team, and leave you with the signed policy doc. Book →