What is the difference between an AI policy generator and an AI disclosure generator?

The generator covered here produces an internal AI use policy: the document that tells employees, contractors, and agents what they may do and how it is enforced. A disclosure generator produces the opposite-facing artifact, a customer or public-facing statement that AI is used in a product or process. Some deployers need both, and they answer different audiences. A regulator reviewing internal governance asks for the policy. A customer asking whether they are talking to a model asks for the disclosure.

What enforces the policy this generator produces?

The generator names the enforcement mechanism in section 7, but it does not deploy one. A gateway, network DLP, or another AI policy enforcement tool has to sit on the request path and act on the rules the policy states, or the policy is a document with no technical backing. DeepInspect is one such enforcement layer; the point holds regardless of which one a deployer runs.

Does the generator handle multilingual policies?

The default output is in US English. Translations into French, German, Spanish, and Italian are available for EU deployers; the translated output is reviewed by a native-speaking compliance professional before release.

What is the legal status of the generated document?

The generator's output is a template awaiting legal review. It carries no legal authority until the deployer's general counsel reviews and the deployer's policy authority signs. The generator produces the first draft from a structured input; legal counsel produces the binding artifact.

Can the generator handle multiple subsidiaries with different regulatory exposure?

The generator handles one entity per run. Deployers with multiple subsidiaries run the generator per subsidiary and consolidate the outputs into the parent policy. The consolidation step typically takes 4 to 8 hours of compliance time.

How does the generated policy stay current as regulations change?

The generator is versioned against the active regulatory text. When the Commission updates an EU AI Act provision or NIST publishes an AI RMF revision, the generator's templates update within 30 days. Deployers running the generator on a quarterly cadence catch the regulatory changes without a separate tracking process.

AI Policy Generator: A Free Tool That Produces a Defensible Internal AI Use Policy in 15 Minutes

A shadow AI policy is the document a regulator reads first when something goes wrong. Most copy-paste templates fail one of two ways. They list rules without the enforcement architecture behind them, so a regulator reading the policy and then reading the deployment finds the gap immediately. Or they cover the wrong scope, asserting prohibitions the deployer has no mechanism to detect.

The AI policy generator runs 12 questions about your organization and produces a defensible markdown document. The seven sections are the ones an EU AI Act Article 26 deployer-obligations review, a HIPAA risk-assessment review, or a Fannie Mae LL-2026-04 assessment will recognize.

TL;DR

The AI policy generator asks 12 questions about your organization and produces a markdown policy covering the seven sections a regulator looks for: scope, permitted use, prohibited use, data handling, identity and authorization, audit and evidence, and enforcement. It pairs with an enforcement layer rather than replacing one. The output is a first draft for legal review, not a finished, signed policy, and it stays versioned against the regulatory text it references.

The seven sections

The generator's output covers:

1. Scope and definitions

Section 1 states who it applies to (employees, contractors, agents-on-behalf, service principals), what counts as an AI system in scope (LLMs, code-assist tools, AI agents, retrieved-context applications), and which regulatory regimes it maps to.

2. Permitted use cases

Named use cases with their data class, route, and approval authority. A clinical-summarization use case on Bedrock Claude under BAA is permitted; a marketing-draft use case on OpenAI direct is permitted with no PHI; a customer-record lookup on a non-BAA endpoint is prohibited.

3. Prohibited use cases

The behaviors that are flatly banned: pasting PHI into non-BAA endpoints, embedding secrets in prompts, using AI for credit decisions that are not covered by the lender's LL-2026-04 evidence chain, using consumer ChatGPT for any work product under HIPAA scope. The template around this section draws on the same field-by-field structure covered in the shadow AI policy template.

4. Data handling rules

What data classes are permitted at which routes, what redaction is required, what retention applies, and how the deployer attests to the rules.

5. Identity and authorization

How a user is verified, how an agent acts on behalf of a principal, how a service principal is scoped. The policy names the identity model the gateway implements, so the policy and the runtime architecture agree.

6. Audit and evidence

The audit-record fields the deployer commits to, and the retention window that applies to each one. The query interface a regulator or internal auditor would use to pull records, and the tamper-evidence chain that proves nothing was altered after the fact.

7. Enforcement and consequence

What happens when the policy is violated. The technical control (gateway block), the operational consequence (incident review), and the employment consequence (HR escalation). A policy without consequences is a posture document; a policy with technical controls is a posture.

The 12 input questions

The generator asks which regulatory regimes apply (EU AI Act, HIPAA, DORA, Fannie Mae LL-2026-04, ISO 42001, plus any sector-specific rule), what the top 5 sanctioned use cases are, and whether any of those use cases sit in an EU AI Act Annex III high-risk category, fall under BAA scope for a healthcare deployer, or trigger the LL-2026-04 evidence chain for a credit-decision-influencing use.

It also asks for the deployer's identity provider (Okta, Entra, Google, Auth0), whether agentic AI patterns such as Claude Computer Use or OpenAI tool use are in scope, and what audit retention applies: six months by default under the EU AI Act, longer where sector law requires it.

The remaining questions name who owns the policy (CISO, AI risk officer, compliance lead), what the enforcement mechanism is (gateway, network DLP, both, neither yet), what incident-response chain activates when a violation triggers, and what employee-acceptance mechanism closes the loop (handbook attestation, training completion, plus a signature).

The answers seed the policy template's variables. The output is a markdown file the deployer's legal team edits, the CISO signs, and HR distributes.

Sample excerpt from the generated output

A finance deployer answering questions 1 (EU AI Act + DORA), 2 (loan-narrative summarization, customer-call notes summarization, code-assist for engineers), 5 (yes, LL-2026-04 applies), 7 (yes, agentic patterns), and 10 (gateway deployed) produces:

## Permitted use cases

The following AI use cases are sanctioned under this policy as of August 6, 2026:

### Loan-narrative summarization

- Data class: customer-record (financial)

- Permitted routes: Bedrock Anthropic Claude Sonnet 4.6 (US-East-1), Azure OpenAI gpt-4o (East US 2)

- Identity model: User; subject must resolve to the credit officer's verified principal claim

- Audit fields: subject, route, data_class, policy_version, decision, reason_code, input_hash, output_hash, downstream_consumer (LL-2026-04)

- Retention: 7 years (LL-2026-04 evidence window)

- Authorization: Credit Risk Committee approval logged with reference [CR-2026-031]

### Customer-call notes summarization

...

## Prohibited use cases

The following behaviors are prohibited under this policy. Violation triggers an incident review under §7 and may result in employment action.

1. Pasting any customer record into a non-BAA, non-Bedrock, non-Azure OpenAI endpoint.

2. Using consumer ChatGPT for any task involving customer data, regardless of perceived sensitivity.

3. Embedding any AWS access key, database connection string, or service credential in a prompt body.

...

The generated output is a 1,800 to 3,400 word policy depending on the answers. Most deployers add 15% to 25% of organization-specific text during legal review.

What the generator does not do

The generator does not produce the enforcement layer. The policy names the enforcement mechanism the deployer has committed to (gateway, network DLP, both); the generator does not deploy the gateway. The two are paired: the policy is the attestation, the enforcement layer is the evidence.

The generator does not provide legal review. A policy generated by a template tool, even a structurally complete one, needs review by the deployer's general counsel before it carries authority. The generator produces the first draft; legal review produces the signed version.

When to use the generator

Three triggers:

Before a regulator engagement. A formal inquiry will ask for the policy first. Producing one in a week is harder than producing one in advance.
As the first artifact of a discovery program. Once the six-week discovery framework has run and the deployer has an inventory, the policy is the document that names what the inventory authorizes.
Annually thereafter. Use cases drift, regulations update, the policy needs a refresh. Annual regeneration with year-over-year change tracking is the operational cadence.

DeepInspect

DeepInspect's gateway is the enforcement layer the generated policy references in section 7. The platform enforces the identity model, the data-handling rules, and the audit-record fields the earlier sections define. A deployer that runs the generator and then deploys DeepInspect has a policy and an enforcement layer that agree on the same vocabulary.

Generate your policy at deepinspect.ai/tools/ai-policy-generator. For deployers running the platform, the policy's section 7 names the platform's specific controls; for deployers running other infrastructure, the policy names the enforcement mechanism in generic terms.

Let's talk today.