Employees Are Already Using AI Without Governance — Start Here

What’s in the bundle

• AI Policy Generatora draft-ready AI usage policy$39
• Employee AI Guidelinesplain-language AI guidelines for staff$49
• AI Risk Registera pre-scored AI risk register$29

How to buy

Each tool is purchased independently at its standard price. No subscription, no account, no bundled checkout — generate on any timeline, in any order. The bundle exists to frame the 3 tools as one programme; the purchase remains pay-as-you-generate.

Frequently asked

Our employees are already using ChatGPT and we have no policy — where do we start?

Three artefacts, in this order: a written AI usage policy (the rule), plain-language employee guidelines (the version staff actually read), and a risk register (what could go wrong and who owns the fix). Skipping the policy and going straight to guidelines leaves no formal document to show a regulator or auditor; skipping guidelines leaves staff with a legal document they won’t read. This bundle generates all three the same afternoon.

Is a written AI usage policy legally required, or just good practice?

It depends on your jurisdiction and sector — this bundle doesn’t assume one universal mandate. What is broadly applicable in the EU is Article 4 of the EU AI Act, which requires providers and deployers to ensure a sufficient level of AI literacy among staff, in force since 2 February 2025; a written policy and guidelines are the natural evidence of having discharged that duty. Outside the EU, the driver is more often a vendor questionnaire, an internal audit, or a works council request than a single statute — but the same three artefacts satisfy all of those asks.

What's the actual difference between the policy and the employee guidelines?

The AI Policy Generator produces the formal governance document — acceptable use, data handling, accountability roles, and jurisdiction-specific compliance obligations, with regulatory citations attached to each section. Employee AI Guidelines produces the plain-language layer staff actually read day to day — golden rules, a data-handling guide by data type, role-aware guidance, and a no-blame escalation process. Handing staff the legal policy instead of the guidelines is one of the most common reasons AI guidance gets ignored.

Do we need the risk register on day one, or can that wait?

It’s the artefact a vendor questionnaire or internal audit asks for by name, separately from the policy — a policy document doesn’t substitute for documented risk management. Waiting means the first time it gets built is under audit pressure rather than on your own timeline. Building it alongside the policy and guidelines, while the context (jurisdiction, industry, risk appetite) is already defined, is faster than building it later from scratch.