A workable AI-code policy makes one rule unmistakable: the person who accepts and ships a change remains accountable for it, whether AI wrote none, some, or most of the code. Set approved tools and data boundaries, require human review and appropriate security checks, and record AI assistance in a way that helps reviewers verify the change without collecting unnecessary prompt data.
Start with scope and clear ownership
Define what the policy covers before setting requirements. AI assistance can include code completion, chat-generated snippets, generated tests, agent-authored changes, code-review comments, and contributions to open-source projects. State which tools are approved, which uses are allowed, and who can approve an exception.
Assign an individual contributor as the owner of every accepted change. That person should understand the change well enough to explain its behavior and answer reviewers’ questions. Microsoft’s Windows development guidance puts the principle plainly: “The code your AI agent generates is code you ship, and you are accountable for everything in your app regardless of how it was written.” Microsoft’s guidance on security and responsible AI is written for Windows development, but this accountability principle can be adopted as a general organizational rule.
Set review and verification requirements
Treat generated output as untrusted code, not as a verified implementation. The contributor should read and understand it, and the organization should apply its existing secure-coding expectations, review process, testing requirements, and analysis practices. GitHub’s Terms of Service similarly state: “You are responsible for reviewing, testing, and validating any Output before use.” GitHub’s terms apply to GitHub AI Features; check the terms that govern each tool your organization uses.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
Make verification proportional to a change’s impact, reach, and uncertainty. These are policy examples to tailor to your architecture, not a universal risk taxonomy:
- Routine, low-impact changes: Use the normal peer review and testing process for the repository. A small completion still needs to be understood and checked.
- Changes with broad or uncertain effects: Require more review evidence for large changes, cross-module changes, or changes exposed to external users. Ask for tests appropriate to the behavior and review relevant analysis findings.
- Security-sensitive changes: Require focused scrutiny for authentication, authorization, cryptography, payments, data access, or deployment boundaries. Consider involving a reviewer with the relevant security or system expertise.
Define how findings from tests, static analysis, or other security checks are recorded and triaged; do not let an AI-assisted label substitute for resolving them. NIST SP 800-218A, the July 2024 final community profile that augments SSDF 1.1 with AI-specific recommendations, says review and analysis policies should include code for AI models and related components. It also recommends scanning AI models for malware, vulnerabilities, backdoors, and other security issues. The profile is a development framework to use alongside SSDF 1.1, not a complete legal policy. Read NIST SP 800-218A.
Rank #2
- Vehicle Inspections Handbook provides step-by-step information CMV drivers need to conduct successful pre-trip, en-route, and post-trip inspections, so they can avoid breakdowns, citations, fines, repair bills, and crashes.
- Information is presented graphically within the vehicle safety handbook so that it's easy to find, with call-outs that address real-life situations drivers may experience during inspections.
- Vehicle inspection book features checklists that drivers can use to ensure successful vehicle inspections.
- Major topics covered include: The importance of vehicle inspections; Key regulations; Preparing for inspections; The inspection process; Vehicle inspection reports (DVIRs); Common inspection violations; and more!
- Softbound handbook measures 5.25" x 8.25", has 76 pages, and is written in English. Copyright 2020.
Approve tools and define data boundaries
Maintain an approved-tool list and verify the terms and settings that apply to the actual account, including any negotiated customer or volume agreement. Set explicit rules for what employees may send to each service. At minimum, prohibit pasting secrets and credentials into prompts, avoid real customer data and personally identifiable information, and decide whether proprietary source code may be sent to an external service.
Do not assume one provider’s terms describe another provider’s service. Microsoft’s developer guidance recommends protecting sensitive data, while GitHub’s general AI Features terms say data-use provisions may vary between individual licenses and customer or volume agreements. Review Microsoft’s data-handling guidance and the applicable GitHub terms; then confirm the current contract and settings for the tools your organization actually uses.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhen comparing tools or contribution types, assess the controls that affect your exposure and ability to govern use:
- Data retention and training terms, including the terms applicable to the organization’s account.
- Whether prompts can be restricted or governed, and whether sensitive data can be excluded.
- Code provenance or similarity controls and the audit trail available to the organization.
- How well the tool fits existing review and testing workflows.
- The applicable contract and the risks of sending sensitive code outside the organization.
Require useful disclosure and proportionate provenance
Specify what a pull request or other change record must disclose when AI materially contributed. A practical record can identify that AI assistance was used, the affected portions, the tool or model if known, and the verification performed. The goal is to give reviewers enough context to check the contribution, not to treat a tool name as proof of quality.
Avoid requiring every prompt to be retained by default. Prompt archives can contain confidential source code, credentials, customer information, or personal data. If a particular use case requires more detailed records, define what is collected, who can access it, and how long it is retained. The GSA TTS AI-Assisted Contribution Policy is one repository-specific example covering accountability, disclosure, provenance, verification, data handling, security review, and licensing. Its authors say it is not official GSA policy or legal advice, so use it as an implementation example rather than an authoritative rule.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep licensing and attribution obligations visible
Do not treat generated code as automatically original, free of rights, or compliant with every license. The contributor and organization should preserve notices and licenses for identifiable third-party material and apply the same license-compliance checks they use for other code. Do not credit a model as the author or let a generic AI disclosure replace attribution that a license or project requires.
GitHub’s terms say it does not claim ownership of input or output, but also warn that output may resemble training data or be subject to third-party copyright or open-source terms. Users are responsible for determining whether a license is required. Consult the terms for GitHub AI Features; they do not settle obligations for every provider, contract, or generated snippet.
Legal questions require separate care. The U.S. Copyright Office’s AI study page lists publication of Part 2, on copyrightability of generative-AI outputs, on January 29, 2025, and a pre-publication Part 3, on generative-AI training, on May 9, 2025. Those publication dates do not establish a universal ownership rule for every AI-assisted code contribution. Human contribution, contracts, jurisdiction, and third-party material can all matter. See the U.S. Copyright Office’s AI study page and consult qualified counsel for decisions that depend on a particular jurisdiction or use.
Quick Recap
Put the policy into practice
- Define coverage: List the AI-assisted activities and repositories governed by the policy, the approved tools, and the exception approver.
- Assign ownership: Require a named contributor to understand and stand behind every accepted change.
- Set review tiers: Specify ordinary checks for low-impact changes and additional review, tests, or analysis for high-impact or uncertain changes.
- Set data rules: Document prohibited prompt content and when, if ever, proprietary code may be sent to an external service.
- Standardize change records: Tell contributors what AI-assistance disclosure and verification details to include, without defaulting to full prompt retention.
- Preserve license checks: Keep third-party notices, attribution requirements, and normal license-compliance processes in force.
- Revisit controls: Review approved tools, their current terms and settings, and the policy’s exceptions as services or organizational requirements change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
