AI policy

Without a policy, staff either avoid AI entirely or use it without guardrails. A clear policy is the first thing people look for and the basis every other control refers to.

Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).

1. GOV-01.1 An approved AI policy states which parts of the organisation, uses and systems AI governance covers.
2. GOV-01.2 The policy states which uses of AI are permitted, which need approval and which are prohibited.
3. GOV-01.3 The policy's prohibited uses include the practices that the law bans.
4. GOV-01.4 The policy has a named owner and a review date.
5. GOV-01.5 The policy has been communicated to all staff.
6. GOV-01.6 The policy and its supporting governance documents are approved, version-controlled and retained.
7. GOV-01.7 Acceptable use terms are set for users of AI services the organisation offers to others, and are reviewed. PRV
8. GOV-01.8 Breaches of the acceptable use terms by users of the organisation's AI services are acted on. PRV

• Is there an AI policy approved at the right level, and when was it last reviewed?
• Does it distinguish uses that are permitted, need approval, and are not allowed?
• How would a member of staff find it, and how do you know they have?

• The approved policy, with owner, approval record and review date
• Communication or training records showing staff were told about it
• Change history showing reviews have happened
• A stated scope for AI governance, and version control and retention for governance documents
• Practices banned by law included in the prohibited list

1. Write a policy that states what AI governance covers (which parts of the organisation, which uses and which systems) and sorts uses into permitted, approval-required and prohibited, with practices banned by law listed as prohibited.
2. Where the organisation offers AI services to others, set acceptable use terms for those users and decide how they are enforced and reviewed.
3. Name a policy owner and review date, get the policy approved, and keep it and its supporting governance documents under version control and retention.
4. Communicate the policy to all staff and check they know where to find it (see PPL-01 and GOV-08).

Common pitfalls

• Writing a policy that lists principles but never says which uses are allowed, need approval or are banned.
• Letting supporting documents drift out of version control so nobody knows which is current.

Starter artefacts

• AI policy template with scope, permitted, approval-required and prohibited uses
• Acceptable use terms for external users of AI services
• Governance document register with versions and retention

Accountable

executive sponsor

Contributors

ai governance lead, risk lead, security lead

Depends on

GOV-02

Roadmap step

2

Lifecycle

strategy, design, operate

direct: this control at Level 3 meets the item. partial: it covers part of it.