SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillspolicy-starter

policy-starter

General & other

View repository

Updated 10-15 20:29

About this skill

/policy-starter
  1. Read ~/.claude/plugins/config/claude-for-legal-zh/ai-governance-legal/CLAUDE.md → regulatory registry (applicable regulations), AI system inventory (AI already in use), the company's practice positions (risk appetite, transparency commitments).
  2. Run the following workflow.
  3. Determine the audience → select a template → fill in the company's specific content → output the draft.
  4. Attach a "still to be decided" list—issues that the draft policy cannot resolve and that need a human to make the final call.
/ai-governance-legal:policy-starter "内部员工AI使用政策"
/ai-governance-legal:policy-starter "面向用户"
/ai-governance-legal:policy-starter
[省略参数以获取受众选择提示]
AI Usage Policy Drafting

Purpose

An AI practice without an AI usage policy is running naked. Regulators, customers, and users all want to know: Do you use AI? Where do you use it? How do you use it? What data is used for training? This skill drafts a first draft of an AI usage policy based on your actual practices and regulatory obligations.

Load the current state

Read ~/.claude/plugins/config/claude-for-legal-zh/ai-governance-legal/CLAUDE.md：

  • ## 监管注册表 — the applicable regulations, which determine the policy's compliance baseline
  • ## AI系统清单 — the AI already in use or planned for use—the policy cannot do more or less than what is actually done
  • ## 红线 — what will absolutely not be done—the policy should reflect these red lines
  • ## 实践位置 — the company's risk appetite, transparency stance, and AI usage principles

Workflow

Step 1: Determine the audience and scope

Audience Purpose Typical content
For users/the public Inform users how the company uses AI to process their data or provide services The existence of AI systems, the nature of AI decisions, how users can obtain human intervention, and how data is used
Internal employees Regulate employees' use of the company's AI tools Available tools, prohibited behaviors, data security requirements, and approval processes
Partners/clients (B2B) Inform business clients about the use of AI in their services Availability of AI features, data protection, and liability commitments

If the user does not specify, ask: "Who is this policy for? (1) Users/the public, (2) Internal employees, (3) Both."

Step 2: Extract content from the inventory and registry

The specific content that must be included in the policy comes from existing configurations:

  • From ## AI系统清单 extract:
    • List of deployed AI systems (classified by risk level and function)
    • Which ones involve personal information processing
    • Which are public-facing and which are internal
  • From ## 监管注册表 extract:
    • Disclosure obligations required by regulations (for example, Article 15 of the Measures for the Administration of Generative Artificial Intelligence Services requires labeling AI-generated content [法条原文]）
    • User rights required by regulations (complaint and reporting mechanisms, the right to refuse automated decision-making, etc.)
    • Industry-specific requirements
  • From ## 红线 extract:
    • Types of AI use cases that are absolutely prohibited
    • Bottom-line principles that need to be publicly stated in the policy

Step 3: Draft the policy

AI usage policy template for users/the public

# AI使用说明

最后更新：[日期]

## 我们使用的AI技术

[公司名称]在以下服务和功能中使用了人工智能（AI）技术：

| AI功能 | 用途 | 涉及的个人信息 | 是否有自动化决策 |
|--------|------|---------------|-----------------|
| [功能] | [用途] | [数据类别] | 是/否 |
| [功能] | [用途] | [数据类别] | 是/否 |

## AI如何影响你

### 内容推荐
[如果使用算法推荐：说明推荐逻辑的基本原则，如何关闭个性化推荐]

### AI生成内容
[如果提供生成式AI服务：说明生成内容的标识方式，不构成专业建议的声明]

### 自动化决策
[如果使用自动化决策：说明决策的逻辑，用户获得人工介入和拒绝仅通过自动化决策的方式]

## 我们不会用AI做的事

[基于红线清单列出底线原则，例如：]
- 我们不使用AI进行社会信用评分
- 我们不基于种族、民族、性别等因素在交易条件上实行差别待遇
- 我们不会在未取得你同意的情况下，将你的个人信息用于AI模型训练

## 你的权利

[根据适用的法规（《个人信息保护法》《生成式人工智能服务管理办法》等），你享有以下权利：]
- [权利及行使方式]
- 如果你对我们的AI使用有任何问题或投诉，请通过[联系方式]联系我们。我们会在[时间]内回复。

## 我们如何管理AI风险

- 我们在部署新的AI功能前进行安全评估
- 我们对AI生成内容进行内容管理和人工审核
- [其他措施]

AI usage policy template for internal employees

# 内部AI使用政策

最后更新：[日期]
适用范围：全体员工、外包人员、实习生

## 可使用AI的场景

[列出允许使用AI的工作场景——可参考方案：正面清单方式（明确列出允许的场景）或负面清单方式（列出禁止的场景，其余默许）]

## 必须遵守的规则

### 数据安全（红线）

1. **禁止向公共AI工具输入敏感信息**：严禁将通过公共网络访问的AI工具（包括但不限于公共版本的大语言模型对话界面）输入以下信息：
   - 客户个人信息
   - 公司商业秘密或未公开的商业信息
   - 涉及国家秘密和安全的信息
   - 未公开发布的产品或财务数据

2. **API集成需审批**：通过API将AI工具集成到公司系统的，必须事先获得技术部门和法务部门的审批。

3. **输出审核**：AI生成的内容在对外使用（发送给客户、发布到网上、用于合同或法律文件）之前，必须经过人工审核。

### 知识产权

- 使用公共AI工具生成的代码、文本、设计等，可能涉及知识产权侵权风险——不得直接用于对外交付物，除非经过充分的权属和原创性审核。
- 员工使用AI工具辅助完成的智力成果，权利归属按照公司知识产权管理制度执行。

### 准确性

- AI工具可能产生不准确、过时或有偏见的信息。不得将AI输出作为唯一决策依据。
- 涉及法律、财务、医疗等专业判断时，AI输出仅供参考，最终判断应由具备相应资质的专业人员作出。

### 透明度

- 在适当情况下，向同事或客户披露你使用了AI工具辅助工作。不得假装AI生成的内容完全是人写的。

## 审批的AI工具清单

| 工具名称 | 用途 | 批准日期 | 使用条件 |
|----------|------|----------|----------|
| [工具] | [用途] | [日期] | [条件] |

使用不在清单上的AI工具前，必须得到[审批人/部门]的批准。

## 违规后果

违反本政策的，将按照公司《员工手册》及信息安全管理制度处理，情节严重者可能面临纪律处分直至解除劳动合同。

Step 4: Supplement the "still to be decided" list

A first draft of a policy cannot solve all problems. Along with the policy, output a list of items that still need to be decided:

## 随政策初稿附：仍需人工决定的事项

以下事项需要公司决策层拍板，不应由AI代为决定：

| # | 问题 | 为什么需要人决定 | 建议 |
|---|------|-----------------|------|
| 1 | [例如：是否允许员工使用公共免费的AI工具处理非敏感业务数据？] | [涉及效率与安全的权衡] | [倾向建议] |
| 2 | [例如：AI使用政策是单独成文还是融入现有隐私政策？] | [涉及法律文书结构和受众] | [倾向建议] |

Step 5: Regulatory Compliance Benchmark Check

Before delivering the draft policy, conduct a self-check against the key requirements of applicable regulations:

Regulatory Requirement Does the policy cover it? Clause Location
Article 15 of the Measures for the Administration of Generative AI Services: Labeling of generated content ✅/⚠️/❌ [Section]
Article 11 of the Measures for the Administration of Generative AI Services: Protection of user information ✅/⚠️/❌ [Section]
Article 15 of the Measures for the Administration of Generative AI Services: Complaint and report mechanism ✅/⚠️/❌ [Section]
Article 16 of the Provisions on the Administration of Algorithm Recommendations for Internet Information Services: Algorithm recommendation notification + opt-out option ✅/⚠️/❌ [Section]
Article 17 of the Personal Information Protection Law: Notification of personal information processing ✅/⚠️/❌ [Section]
Article 24 of the Personal Information Protection Law: Transparency of automated decision-making + right to refuse ✅/⚠️/❌ [Section]

Step 6: Output

Save the draft as a dated markdown document. Attach the compliance benchmark check and the list of items that still need to be decided.

[工作成果头 — 按照插件配置 ## 输出]

# AI使用政策草案 — [内部/面向用户/两者兼有]

**日期：** [日期]
**状态：** 初稿，待法律审阅
**基于：** [AI系统清单中的N个系统] | [N项适用法规]

---

[以上政策正文]

---

## 监管合规对标检查

[以上表格]

---

## 仍需人工决定的事项

[以上表格]

Wrap-up

Conclude with the next-step decision tree specified in CLAUDE.md ## 输出 . Customization options: review and approve policy language, address open items in the "still need to decide" list, coordinate consistency with the privacy policy, escalate for legal counsel review.

What this skill does not do

  • It does not make legal judgments—when there are ambiguities in the draft policy, flag them as "still need to decide" rather than making the call on someone's behalf.
  • It does not replace external legal advice—if it is a high-risk scenario or the policy is released to the public, it should be finalized by a lawyer.
  • It does not cover non-AI-related privacy policy content—it covers only the AI part. If a complete privacy policy is needed, see the privacy-legal plugin's policy-starter。