Rules employees can use
AI Governance Policy Template for Saudi SMEs
Adapt eleven practical AI policy clauses for a Saudi SME, with an approval schedule, an events-company example and a scenario-based rollout test.
A small business needs an AI policy that employees can follow during an ordinary working day. The policy should answer which uses are approved, what information may be entered, who checks outputs and what to do when something goes wrong. A document that lists principles without those decisions leaves staff to create their own rules.
This template is for a Saudi SME introducing a limited set of AI uses. The proposed clauses are internal rules to adapt and approve, not an official government form. They do not establish compliance by themselves. Where the Personal Data Protection Law applies, a company policy must support the underlying duties rather than replace them.
Make four decisions before adopting the wording
Name the policy owner and deputy, choose the initial approved uses, establish the information boundary for each, and identify the person authorised to approve exceptions. Use existing roles where suitable. A small company does not need to invent a new department merely to maintain a policy, but someone must have time and authority to do the work.
Review the policy against existing confidentiality, information security, employment and procurement arrangements. Resolve conflicting instructions. If a sector or customer requirement applies, incorporate the relevant obligation through its responsible owner. The guides to Saudi business AI governance and NCA applicability help frame that assessment.
Proposed policy clauses
1. Purpose and coverage
This policy governs AI use for company work by employees and authorised contractors, including AI features embedded in existing software. Its purpose is to support useful work within approved information, authority and review boundaries. Approval relates to a defined use and configuration; it does not automatically cover every feature of a product.
2. Approved-use register
The policy owner maintains a current register showing the tool, account or plan, business purpose, permitted users, allowed information, required review and responsible owner. Staff use company-approved arrangements for company work. New uses and material changes require review before they are added to the register.
3. Information permitted in AI services
Staff enter only information permitted for the registered use. Personal, confidential or customer-restricted information must not be placed in an unapproved service. Removing a name alone does not establish that information is safe to share. Where the boundary is unclear, staff seek approval before uploading or connecting a source.
4. Review of outputs
The responsible employee checks material facts, calculations, source references and suitability before using an output in a business decision or external communication. The level of review follows the consequence of the task. An output that cannot be verified is corrected, escalated or withheld; fluent wording is not evidence of accuracy.
5. Authority to act
AI may take only the actions explicitly approved for the registered use. Authority to draft does not include authority to send, publish, purchase, approve or change a record. Any proposed expansion of action authority requires a separate decision identifying limits, human responsibilities and evidence of safe operation.
6. Procurement and account changes
The business owner involves the designated procurement or contract owner before purchasing an AI service or enabling a material new feature. The review covers the intended use, information handling, relevant providers, support and exit arrangements. A personal subscription or free trial does not create company approval.
7. Records and retention
Keep the records necessary to explain material approvals, checks, incidents and changes in the approved company location. Apply the organisation's applicable retention and access rules. Do not retain every prompt or copy sensitive information into a general register merely because a record might be useful later.
8. Problems and incidents
Staff promptly report suspected information exposure, unauthorised action, harmful output or repeated material failure through the named internal route. They stop the affected task where instructed and preserve relevant evidence without spreading sensitive material. The responsible owners assess containment, investigation and any external obligations through the applicable process.
9. Exceptions
An exception must identify the use, reason, information boundary, responsible owner, conditions, expiry and review trigger. Only the designated authority may approve it. An exception to an internal rule does not waive an applicable legal or contractual obligation. Expired exceptions require a new decision before the exceptional use continues.
10. Capability and support
Users receive guidance appropriate to their tasks and know where to obtain help. Managers confirm that reviewers have the information, competence and time required. The policy owner keeps practical examples current and coordinates additional support when a role or service changes materially.
11. Review and accountability
The policy owner reviews the register and policy at the approved interval and when incidents, new services or changed obligations make review necessary. Business owners report changes to their uses. Decisions and corrective actions are recorded, and unresolved matters go to the designated executive authority.
Attach a short operating schedule
The clauses need a usable companion record. Complete the following schedule with actual decisions rather than publishing unresolved blanks to employees. Keep it accessible in the same place as the policy.
| Item | Required entry |
|---|---|
| Policy authority | Approver, version, effective date and next review condition |
| Owner and cover | Named policy owner, deputy and internal contact route |
| Approved uses | Link or location of the current use register |
| Information rules | Applicable classification guidance and decision contact |
| Incident reporting | Practical reporting route and out-of-hours arrangement where needed |
| Exceptions | Authorised approver, evidence location and expiry tracking |
| Related policies | Current confidentiality, retention, access and procurement references |
Test the schedule with a staff member who did not write it. Ask them to find the approved tool, decide whether a sample document is allowed and report a simulated problem. If they cannot do those things, improve the route or wording before treating acknowledgement as successful implementation.
Worked example: an events company
A fictional Saudi events SME approves an assistant to draft public event descriptions and agenda outlines from published material. The register names a communications owner, requires review before publication and excludes guest lists, private client briefs and automated invitations from that approval.
A project manager later wants personalised guest invitations using a spreadsheet. The policy should make the next step obvious: this is a new information and communication use, so it needs review. The employee does not have to decide the entire legal position alone, and the original public-copy approval cannot be stretched to cover it.
If the company approves a narrower arrangement, record exactly which fields may be used, who verifies recipients and who sends the invitations. Use supplier diligence to examine the service arrangement and the risk register for material unresolved issues. The policy remains short because those decisions have their own records.
Introduce the policy through scenarios
Brief staff with a few examples from their actual work: a permitted task, a prohibited information transfer and a case needing approval. Explain the reason for each boundary and provide an authorised route for useful ideas. A ban without a workable alternative may leave the underlying business need unresolved.
Use task-based capability building for people who review or operate the service. Explain the practical ethical questions through the SDAIA ethics business guide without labelling every proposed internal clause as a statutory duty.
Check implementation after staff begin using the policy. Look for unregistered uses, unclear information decisions, repeated exceptions and delays in the approval route. Update the process based on those findings. The objective is consistent behaviour and accountable decisions, not a signed document that nobody consults.
Open for AI's agentic AI consulting can help assess uses, readiness and workflow authority. Bring your current policy, a redacted tool inventory and two common employee scenarios to discuss a proportionate AI policy for your SME.
FAQ
Your questions, answered.
Can a Saudi SME adopt this AI policy unchanged?
Use it as a working starting point, then resolve actual owners, approved uses, information rules, reporting routes and applicable obligations. Check consistency with existing policies and contracts. The template has no authority until the organisation approves its adapted version, and approval of the document does not prove that the operating controls work.
Should the policy approve tools or individual uses?
Approve a defined use and configuration, including the account or plan, permitted information and required review. A product can support very different activities with different consequences. Recording only a product name can allow staff to assume that confidential analysis, external sending and public drafting are all covered by the same decision.
How should the policy handle personal AI subscriptions?
State the company's rule clearly and provide an approved route for business needs. A personal subscription does not establish company control over information handling, access or contractual commitments. If staff have already used one for work, use the defined reporting and assessment process to understand the use and decide the next step.
Should the policy specify an external incident-notification deadline?
Keep internal reporting prompt and practical, then route external notification decisions through the owners responsible for the applicable requirements. Different events and obligations need assessment. Do not insert one universal external deadline into a generic AI policy without confirming the circumstances, recipient and legal or contractual basis.
How can an SME manage AI policy exceptions simply?
Use a short record with the proposed use, reason, information boundary, owner, conditions and expiry. Identify the authorised approver and track when the decision needs review. An exception should make a limited decision visible, not become an indefinite workaround or a way to waive obligations the business cannot waive.
What is the fastest useful way to test whether staff understand the policy?
Ask staff to handle three realistic scenarios: an approved task, a restricted information request and a suspected incident. Observe whether they can find the current register and contact route and explain the next step. Fix practical obstacles before relying on an acknowledgement checkbox as evidence of understanding.