The document is the cheap part. A usable AI use policy costs between nothing and about $7,500 depending on who writes it, and most companies of 50 to 500 people land near the bottom of that range. Then the real bill arrives: the approval cycle, the all-hands, the manager briefings, the acknowledgment chase, the queue of people asking whether the tool they already installed is allowed. That second half usually runs ten times the drafting fee or more, almost none of it shows up as an invoice, and no pricing page will quote it to you. This page prices both halves and adds them up at three headcounts.
Two bills, one question
Search for what an AI use policy costs and you get two unrelated answers. One set of results prices AI spend governance: token budgets, seat caps, consumption controls. The other prices legal drafting, and the few pages brave enough to publish real fees are pricing the wrong document. Those published flat fees belong to software vendors buying customer-facing paperwork: terms of service, a privacy policy, a data processing agreement, an acceptable use policy for users of their product. One tech boutique advertises that bundle at $5,500 to $7,500 with two revision rounds, which is fair for seven documents.
You are buying something else. An employer’s AI use policy governs your own staff: which tools are approved, what may be pasted into them, what a person has to review before it leaves the building, and what happens when someone gets it wrong. One document, shorter and cheaper. What makes it expensive is everything that has to happen after it is signed.
What the document costs, by route
Four routes, and the spread between them is smaller than vendors would like you to believe.
| Route | Cost of the document | What you get |
|---|---|---|
| Free framework or template | $0 plus 6 to 12 internal hours | A solid skeleton from a security vendor or a public framework. Generic examples, no awareness of your contracts or your sector. |
| Marketplace counsel | about $950 to $1,500 | A lawyer-reviewed document on a flat fee. Fast, light on context. |
| Your own employment counsel | $1,600 to $6,000 | Four to ten hours at $400 to $600 an hour at a tech boutique. Reads your client contracts and your handbook. Worth it if you hold client data under negotiated terms. |
| Consultant-led policy program | $5,000 to $20,000 | Document plus an AI tool inventory, a risk register, and an approval workflow. Appropriate above roughly 500 people or in a regulated sector. |
The baseline route costs nothing because the frameworks are public. NIST’s AI Risk Management Framework sorts the whole problem into four functions, Govern, Map, Measure and Manage, and is free to download. Most commercial templates are that framework with a logo on it.
At 50 to 500 people, in an unregulated sector, with no AI feature in your own product, the document should cost you a few hundred dollars and a week of calendar time. Anyone quoting five figures for the document alone is selling you the program and calling it paperwork.
When the free template is the right answer
Most of the time, at this size. A template handles scope, the approved tool list, a data classification rule, a disclosure requirement, and a human-review clause. Those five cover most of what goes wrong.
Pay a lawyer when one of these is true: your client contracts contain confidentiality or subprocessor language a tool could breach; you work in health, finance, legal or education, where a regulator has views on automated decisions; you have staff or customers in the EU; or you plan to use AI in hiring, promotion or termination decisions, which several states and cities now regulate separately.
Outside those cases, paying $5,000 for a document whose structure is public is a way to feel covered rather than be covered. We have read policies from both routes, and the drafted ones are no better at changing what an employee does at 4pm on a Thursday. That difference lives in the rollout.
What the rollout costs
Here is the part no pricing page itemizes. Every line below is hours, and the hours are real money.
Scoping and tool inventory, 8 to 20 hours. Before a policy can name approved tools, somebody has to find out which tools are in use: expense reports, browser extensions, the shared accounts marketing set up last spring. This step surprises people, because the inventory runs longer than the policy.
Internal review and approval, 10 to 30 hours. Legal, IT, HR and one nervous executive, across two or three rounds. Three to six weeks of calendar time is normal, and the hours sit with expensive people.
Admin configuration, 4 to 16 hours. Naming approved tools implies someone configured them: single sign-on, workspace accounts instead of personal logins, retention settings, whatever controls your plan exposes. Skip this and the policy is aspirational.
Announcement and the all-hands, session time multiplied by your headcount. At 150 people a one-hour all-hands costs 150 person-hours. That single line is often larger than the drafting fee.
Manager briefings, 1 to 2 hours each for 5 to 40 managers. Staff ask their manager, not legal. A manager who cannot answer the question becomes the reason the policy is ignored.
Acknowledgment chasing, 5 to 15 hours. The last 15% of signatures take as long as the first 85%.
The tool-request queue, 2 to 6 hours a month. Someone answers “can I use this one.” Budget it as a standing cost, not a project cost.
Training on the judgment the policy requires, $2,000 to $15,000. The policy states a rule. Applying it means an employee deciding, in a few seconds, whether this document can go into that tool. That is a skill, not a sentence, and hands-on sessions on your own material are how the market builds it. The gap between a written rule and an applied one is the subject of our playbook on policy, training, and the space between them.
Annual refresh, 6 to 15 hours. Tools change, your approved list changes, and a policy naming last year’s stack reads as theater.
Putting a defensible number on an internal hour
Internal hours get waved away because nobody wants to price them. Price them anyway, with arithmetic your CFO can check.
Benefits accounted for 30.0% of total employer compensation costs for private industry workers in June 2026, per the Bureau of Labor Statistics Employer Costs for Employee Compensation release. Since that 30% is a share of the total rather than a markup on salary, divide salary by about 2,000 working hours and multiply by roughly 1.4.
A $90,000 operations manager lands near $64 an hour, a $150,000 director near $107, a $250,000 executive near $179. For mixed groups, $75 is a fair blended figure and the one used below.
The arithmetic at 50, 150, and 500 people
Assume the template route for the document, a one-hour all-hands, and one hands-on training session at the market rate. Rounded to the nearest $250.
| Line | 50 people | 150 people | 500 people |
|---|---|---|---|
| Document | $0 to $1,000 | $500 to $2,000 | $2,000 to $6,000 |
| Scoping and inventory | $750 | $1,000 | $1,500 |
| Review and approval | $1,000 | $1,500 | $2,500 |
| Admin configuration | $500 | $750 | $1,500 |
| All-hands (session time) | $3,750 | $11,250 | $37,500 |
| Manager briefings | $500 | $1,000 | $3,000 |
| Acknowledgment chase | $500 | $750 | $1,500 |
| Training | $2,000 to $5,000 | $4,000 to $9,000 | $9,000 to $15,000 |
| Year-one total | $9,000 to $13,000 | $20,750 to $27,250 | $58,500 to $68,500 |
Two things jump out. The document is under 10% of year one at every headcount, so arguing about the drafting fee is arguing about the smallest line. And the all-hands is the largest line at every headcount, which argues for making it count rather than skipping it. An hour of 500 people’s attention is a $37,500 purchase whether or not anyone writes it down.
Cost after year one is modest: the request queue, the refresh, and a session for new hires. Call it 20% to 30% of year one, most of it hours.
Why the cheap policy is often the expensive one
IBM’s 2026 Cost of a Data Breach Report carries the numbers that should decide this budget. Shadow AI, meaning staff using tools nobody approved, was present in 43% of breached organizations, up from 20% the year before. Over the same period the share of breached organizations with an AI policy in place fell to 32%, down from 37%. The global average breach cost reached $4.99 million, up 12%.
Read those together. Unapproved tool use more than doubled while policy coverage went backward. IBM’s own reading is that AI adoption without governance, rather than AI itself, drives the cost. The 2025 edition put a figure on it: breaches at organizations with high levels of shadow AI cost about $670,000 more than breaches where there was little or none.
Here is what matters for a budget conversation. Policy documents are cheap and plentiful, so 32% coverage among breached firms is not a shortage of templates. It is a shortage of rollout. Money spent on a document nobody can apply buys a defense you will be embarrassed to raise.
So you are not buying compliance cover. You are buying a change in what 150 people do when they are busy. That is an AI enablement problem wearing a compliance label, and it is what you were buying when you bought the licenses, as we argue in why buying licenses is not the same as building capability.
What the EU AI Act adds, and to whom
If you have staff or customers in the EU, Article 4 has required since February 2, 2025 that providers and deployers take measures to support the development of AI literacy among staff and others operating AI systems on their behalf. That is a training duty, not a document duty, and a policy alone does not discharge it.
Ignore the headline compliance figures quoted at you. The widely repeated €400,000 per-product number comes from a CEPS study that has since corrected its own misquotation: it describes building a quality management system from scratch, at €193,000 to €330,000 plus roughly €71,400 a year to maintain, for providers of high-risk systems that have no such system. CEPS assumes 10% of AI systems carry compliance cost at all, against a Commission expectation of 5% to 15%.
A 200-person US company using ChatGPT, Claude, Gemini or Microsoft Copilot for drafting and analysis is a deployer of low-risk systems. The realistic added cost is counsel time to confirm your tier plus the literacy measures, not six figures. Confirm the tier rather than assume it.
Do you need governance software for this
Below 500 people, usually not. At 150 people with four approved tools and a spreadsheet, a platform solves a problem you do not have yet. What you do need is the admin side of the tools you already pay for: workspace accounts, single sign-on, retention controls, whatever audit log your plan exposes. That is configuration work, already in the table above, and the step most often skipped.
Who should hold the budget
Whoever can make managers brief their teams. In practice that is the COO or the head of operations, not legal and not IT, and if someone already owns AI enablement at your company, it belongs to them. Legal writes the clauses, IT configures the tools, and neither can make a sales manager spend fifteen minutes on this in a Monday meeting.
Boards and executive teams need a shorter, different version with its own price points, covered in our guide to governance training for leaders and directors. Keep that budget separate; merging the two serves neither group.
The cheapest version that still binds
If the budget is genuinely thin, this is the order we would spend in.
- Inventory what is already in use. Free, and it changes what the policy has to say.
- Cut a public framework down to one page people will read. A day of someone’s time.
- Configure workspace accounts and retention on the tools you approve. Hours, not dollars.
- Run one hands-on session on your own documents, where people practice the judgment the policy asks for. Protect this line when something gets cut.
- Brief managers before the all-hands, not after.
- Have counsel review the document once your contracts or your sector demand it, which may be later than you think.
Skip the governance platform. Skip the five-figure drafting engagement. Spend on the part that touches behavior, which is also the part a per-seat training license does not reach, as we cover in what AI risk training does that security awareness training does not. If you want a second opinion on where your own number lands, a free AI-readiness call will get you a scoped estimate in half an hour.
Frequently asked questions
How much does it cost to write an AI use policy?
Between $0 and $7,500 for the document. A free framework plus internal editing costs nothing but 6 to 12 hours; marketplace counsel runs about $950 to $1,500; your own employment counsel runs $1,600 to $6,000 at four to ten hours of tech-boutique time. The five-figure quotes you will see are for a policy program with an inventory, a risk register and an approval workflow attached.
Can we just use a free template?
Yes, for most companies of 50 to 500 people in an unregulated sector. The public frameworks cover scope, approved tools, data classification, disclosure and human review, which is where most incidents live. Pay for counsel when your client contracts, your sector, EU exposure or an employment-decision use case puts a real legal question in front of you.
What does the rollout cost on top of the document?
Ten times the drafting fee or more, mostly in hours. Year one lands around $9,000 to $13,000 at 50 people, $20,750 to $27,250 at 150, and $58,500 to $68,500 at 500, with the all-hands as the single largest line at every size.
How long does the whole thing take?
Six to ten weeks. Inventory takes one to two, drafting takes one, review and approval takes three to six, the rollout takes two. Companies that compress it usually skip the manager briefings, which is also how a policy ends up ignored.
Who should own the AI use policy?
Operations. Legal drafts the clauses and IT configures the tools, but neither can make managers carry the message to their teams, and that is what determines whether anything changes.
Does the EU AI Act apply to us if we are a US company?
If you have staff or customers in the EU, Article 4’s AI literacy duty covers the people operating AI systems on your behalf. Most US mid-market companies are deployers of low-risk systems, so the realistic cost is counsel time to confirm the tier plus the literacy measures. The six-figure numbers in circulation describe high-risk providers building quality management systems from scratch.
Do we need AI governance software?
Below roughly 500 people and a handful of approved tools, no. Platforms start near $5,000 a year and run to six figures, and pay off when you have many AI systems, model risk to document, and an auditor to satisfy. Configure the admin controls in the tools you already license first.
Is training a separate line, or can the all-hands cover it?
Separate. An all-hands tells 150 people the rule exists. It cannot give them practice applying it to their own documents, which is what changes behavior. Hands-on sessions run $2,000 to $15,000 by scope and group size; per-seat awareness platforms price differently again, which we break down in what AI security awareness training costs.
Key takeaways
- The document is under 10% of year-one cost. Arguing about the drafting fee is arguing about the smallest line on the page.
- Price internal hours or the budget is fiction. Salary divided by 2,000, times about 1.4, on the BLS 30% benefits share.
- The all-hands is the biggest line at every headcount. At 500 people it is a $37,500 hour of attention.
- Shadow AI appeared in 43% of breached organizations in IBM’s 2026 report while policy coverage fell to 32%. Documents were not the shortage.
- Governance software is premature below about 500 people. Admin configuration in the tools you already pay for is not.
- Protect the training line when something gets cut. It is the only one that touches what an employee does under time pressure.
Dirk Jan van Veen, PhD
