Visit the full site
AI Policy & Acceptable Use

An AI policy your people can follow, in place in two weeks.

Most mid-market companies now have employees using AI every day and no written rule about it. Hive drafts and helps you adopt a board-approved AI policy, acceptable-use rules for staff and a vendor AI clause for your contracts, written in plain language and sized to your business rather than copied from a Fortune 100 template.

It is the fastest way to put something defensible in place while the larger governance review is scoped, and it stands on its own for companies that only need the documents.

  • Two weeks from kickoff to a policy ready for board approval
  • Fixed fee, agreed before any work begins
  • Written to line up with ISO/IEC 42001 and the NIST AI Risk Management Framework, so it does not need redoing later

Start with a 15-minute call

A short conversation about what you have in place today and whether the policy engagement is the right first step. No preparation needed.

Book a 15-minute call

Pick a time that suits you. Opens the booking calendar.

or request a 30-minute briefing

Thank you.

Your request is in. We will be in touch shortly to set a time.

What you receive

Three documents, written to be used

Each one is drafted with your leadership team, reviewed with whoever owns legal and HR, and handed over ready to adopt. No forty-page binder.

The AI policy

Who answers for AI in the business, what the company will and will not use it for, how new tools get approved, how incidents are handled and how often the policy is reviewed. Four to six pages, written for the board to approve and for managers to understand.

Acceptable-use rules for staff

One page. What employees may put into an AI tool and what they may not, which tools are approved, what to do with AI-generated work, and who to ask. Written so it can be read in five minutes and actually followed.

A vendor AI clause

Contract language for suppliers and software vendors covering notice of AI features, use of your data for training, human review and liability when an AI feature acts wrong. Ready to drop into your standard agreements and renewals.

How it runs

Two weeks, in a set sequence

  1. KickoffA 90-minute working session with leadership to settle the questions a policy has to answer: ownership, risk appetite, approved tools and the lines the business will not cross.
  2. Quick inventoryA short survey of which AI tools are in use today, so the policy reflects reality rather than a blank slate.
  3. Drafting and reviewHive drafts all three documents, then reviews them with your legal, HR and IT leads in one session each.
  4. AdoptionA final version for board approval, a one-page rollout note for managers and a 30-minute staff briefing if you want one.
Built in from the start

Standards alignment

The policy structure follows ISO/IEC 42001 and the NIST AI RMF Govern function, so it holds up if a customer, insurer or auditor asks.

Industry fit

Versions for healthcare, law firms, accounting firms and professional services, reflecting HIPAA, privilege, independence and client-confidentiality obligations.

Agents covered

A short section on AI agents, so the policy does not need rewriting the first time a vendor turns one on.

A path forward

If the quick inventory turns up more than expected, the policy engagement credits toward the full AI Risk & Governance Review.

Common questions

About the policy engagement

We already have a draft policy. Is this still useful?

Often, yes. Most drafts we see were adapted from a large-enterprise template or generated in an afternoon, and they tend to be either too long to follow or too vague to enforce. We can start from your draft, which usually shortens the work.

Is this legal advice?

No. Hive drafts the policy as governance advisors and works alongside your counsel, who reviews and approves the final language. Where you do not have counsel, we can suggest firms in Tennessee who do this work.

How is this different from the AI Risk & Governance Review?

The review is a four-week assessment of everything already in use, measured against two standards, with a risk register and roadmap. The policy engagement produces the documents only, in two weeks, and is the right choice when leadership needs something defensible now. Many clients do the policy first and the review next.

What does it cost?

A fixed fee, quoted after the 15-minute call once we know the size of the organization and whether an existing draft is in play. The fee credits toward the full review if you go on to it.

Put something defensible in place this month

Fifteen minutes is usually enough to know whether the policy engagement or the full review is the right first step.