Skip to content

AI policy framework

  • Draft
  • v0.1.0
  • Governance, risk, and compliance leads
  • Reviewed 2026-07-26

An enterprise policy suite should translate principles into enforceable rules, accountable processes, and measurable evidence.

  • acceptable and prohibited AI use;
  • system inventory and risk classification;
  • data, records, intellectual property, and confidentiality;
  • procurement and third-party AI;
  • model, prompt, agent, and tool lifecycle management;
  • human oversight, notice, explanation, and redress;
  • evaluation, testing, red teaming, and independent assurance;
  • security, privacy, resilience, and incident response;
  • production monitoring, material change, and retirement; and
  • transparency, regulatory reporting, and public disclosure.

Policy quality checks

Policies should identify scope, authority, accountable owner, normative requirements, exceptions, evidence, enforcement, review interval, training, and related standards. Requirements must be implementable and testable. Control effectiveness requires implementation evidence beyond policy publication.