{
  "version": "2026-09-19",
  "licence": "CC BY 4.0",
  "note": "The question set, data classes, tool classes and posture options behind the pk-sharma.com AI acceptable use policy generator. Policy prose is composed deterministically in the visitor's browser. Grounded in EU AI Act Articles 4 and 50 and ISO/IEC 42001 expectations; no standard text is reproduced.",
  "lastReviewed": "2026-09-19",
  "postures": [
    {
      "id": "permissive",
      "label": "Enable broadly, with boundaries",
      "note": "Approved tools are available to everyone, with clear rules on what must never go in. Suits organisations where the work is largely non-sensitive and shadow use is already widespread."
    },
    {
      "id": "guarded",
      "label": "Enable by role, with review",
      "note": "Access follows role and data exposure, and higher-risk uses need sign-off. The common landing place, and the one that survives an audit best."
    },
    {
      "id": "restrictive",
      "label": "Restrict to approved use cases only",
      "note": "Nothing is permitted until a named use case is assessed and approved. Appropriate for regulated work and for anyone handling special category data at scale."
    }
  ],
  "dataClasses": [
    {
      "id": "personal",
      "label": "Personal data about identifiable people"
    },
    {
      "id": "special",
      "label": "Special category data (health, biometrics, beliefs)"
    },
    {
      "id": "client",
      "label": "Client or customer confidential information"
    },
    {
      "id": "financial",
      "label": "Unpublished financial information"
    },
    {
      "id": "credentials",
      "label": "Credentials, keys and secrets"
    },
    {
      "id": "source",
      "label": "Proprietary source code"
    },
    {
      "id": "legal",
      "label": "Legally privileged material"
    },
    {
      "id": "hr",
      "label": "Employee records and HR case material"
    }
  ],
  "toolClasses": [
    {
      "id": "assistants",
      "label": "General assistants (chat, drafting, research)"
    },
    {
      "id": "embedded",
      "label": "AI features inside software you already licence"
    },
    {
      "id": "coding",
      "label": "Coding assistants"
    },
    {
      "id": "meeting",
      "label": "Meeting transcription and note-takers"
    },
    {
      "id": "agents",
      "label": "Agents that take actions on your behalf"
    },
    {
      "id": "image",
      "label": "Image, audio or video generation"
    }
  ],
  "questions": [
    {
      "id": "orgName",
      "label": "Organisation name",
      "required": true
    },
    {
      "id": "owner",
      "label": "Policy owner",
      "required": true
    },
    {
      "id": "audience",
      "label": "People covered",
      "required": true
    },
    {
      "id": "industryContext",
      "label": "Industry or risk context",
      "required": false
    },
    {
      "id": "effectiveDate",
      "label": "Effective date",
      "required": true
    },
    {
      "id": "euScope",
      "label": "EU AI Act scope",
      "required": true,
      "options": [
        "yes",
        "no",
        "unsure"
      ]
    },
    {
      "id": "posture",
      "label": "Overall position",
      "required": true,
      "options": [
        "permissive",
        "guarded",
        "restrictive"
      ]
    },
    {
      "id": "toolClasses",
      "label": "Tool classes in use",
      "required": true
    },
    {
      "id": "approvedTools",
      "label": "Approved tools and account tiers",
      "required": true
    },
    {
      "id": "approvedUses",
      "label": "Approved use cases",
      "required": true
    },
    {
      "id": "accountRule",
      "label": "Business and personal account rule",
      "required": true,
      "options": [
        "business-only",
        "approved-any"
      ]
    },
    {
      "id": "prohibited",
      "label": "Prohibited data classes",
      "required": true
    },
    {
      "id": "approvalRoute",
      "label": "Tool and use-case approval route",
      "required": true
    },
    {
      "id": "incidentRoute",
      "label": "Incident and concern reporting route",
      "required": true
    },
    {
      "id": "exceptionRoute",
      "label": "Exception decision route",
      "required": false
    },
    {
      "id": "builds",
      "label": "Builds, configures or integrates AI",
      "required": true,
      "options": [
        "yes",
        "no"
      ]
    },
    {
      "id": "acknowledgement",
      "label": "User acknowledgement",
      "required": false,
      "options": [
        "yes",
        "no"
      ]
    },
    {
      "id": "reviewCadence",
      "label": "Review cadence",
      "required": true,
      "options": [
        "quarterly",
        "biannual",
        "annual"
      ]
    }
  ]
}