AI Policy Template: From One Page to Auditor-Ready Five Pages

TL;DR

A one-page AI safety policy is the artifact Module 0 asks you to write. A five-page pack adds owners, logs, human review, and allowed tools. Neither page is a security architecture. Both are how a deployer proves they know Safety ≠ Security.

Start with one page staff will sign. Expand to five pages an auditor can follow.

Key Takeaways

• Safety = protect people from the model (accidental harm: bias, hallucinations, leaking PII, over-reliance) — guardrails. Security = protect the model from attackers (adversarial: prompt injection, breaches, exfiltration). Intent is the key distinction.
• Page one: owner, allowed uses, what never goes in a prompt.
• Pages two to five: disclosure, logs, incident path, vendor list, review cadence.

Why one page first

HR will not sign a 40-page governance PDF this quarter. They will sign a page that names the owner, bans secrets in prompts, and says who can override the model. That is the free template. Write it in your classroom after the three public videos.

What the five-page pack adds

The longer pack is Module 5’s outcome, not a public download. It turns the one-pager into something a deployer can show counsel: purpose of each system, human review triggers, logging, retention, vendor inventory, and a date to revisit. Auditors ask “who decided this model could talk to customers?” The five-pager answers with a name.

What never belongs in either document

Do not paste a CISO red-team runbook into the staff policy. Security controls belong with security. The safety policy is for accidental harm: bias, hallucinations, leaking PII, over-reliance. If you mix the two, builders skip the file and CISOs ignore the one-pager.

Enter the free classroom

Watch Module 0 — Why AI Safety Is Not Security — with no login. Write and quiz stay in your classroom. Unlock M1–M5 for $199. If you are a deployer, also read the EU AI Act deployer page.