Enter once, for the organisation as a whole. Go as deep as your organisation letter, and implement in your mode.
Why it exists
Before you deploy any AI, write down why the organisation uses it at all, what it is allowed to do, and how much risk leadership is prepared to accept. This is not a mission statement exercise. An AI policy that cannot answer “why” will not survive its first hard decision — the first time a business unit wants a tool the policy is silent about, or the first time an incident forces leadership to explain what the AI was for. Write the purpose down while it is still a choice, not while it is being reconstructed for a regulator or a journalist.
Govern AI as a capability multiplier, not as a headcount-reduction tool. State explicitly that its purpose is to remove routine, repetitive work so that your people can spend their time on judgement, relationships, and problems machines cannot handle — and hold every initiative to that standard. The distinction is not cosmetic: an organisation that frames AI as replacement invites quiet sabotage, hidden non-adoption, and the loss of exactly the institutional knowledge the AI depends on. Frame it as augmentation, and demand that the augmentation be proven.
What to actually do
Tie every AI use to a measurable business outcome. Do not accept “it makes us more efficient” as a justification. If an AI assistant compresses a task from one hour to fifteen minutes, record that gain against a named objective — a target the organisation already tracks — and review whether it materialises. Measured value is what justifies both the spend and the risk of each deployment; unmeasured claims breed hype in the good years and indiscriminate cuts in the bad ones.
Document and stabilise the process before you automate it. Placing AI on top of a broken or undocumented process does not fix the process; it scales the inefficiency and hard-codes the chaos, faster. Before you delegate any workflow to an AI system — above all to one that acts on its own — require that the workflow be written down step by step: who does what, in what order, with what handoffs. A simple diagram is enough. A process no one can describe is a process no one can safely delegate. Map it, stabilise it, and only then automate it.
Rest the policy on named values, not only on prohibitions. State the ethical commitments the organisation holds itself to when it uses AI: accountability for outcomes, fairness toward the people affected, respect for privacy, robustness and safety of the systems, transparency about their use, and a refusal to produce or spread deliberate falsehood. You are not writing philosophy; you are giving every later decision — every approval, every dispute, every incident — a fixed point to be judged against. The detailed practice of each value lives in its own domain of this framework; the commitment is declared here, once, at the top.
Declare the autonomy red lines, not only the data red lines. Almost every organisation writes down which data AI may touch. Almost none writes down which degrees of independent action are unacceptable — and that omission is where the real incidents now come from. State, in the policy itself, lines such as: an AI may draft an external message but may not send it; may recommend a payment but may not execute it; may propose a decision about a person but may not take it. These lines exist to be inconvenient. Draw them before a vendor demo makes them negotiable.
Tell people when they are dealing with AI. Adopt, as policy, that users, customers, and affected parties are told when an output or an interaction is produced or mediated by AI. Regulators in Europe and in a growing number of other jurisdictions already require this for many uses; treat it as your floor everywhere, because it is one of the cheapest obligations to meet and one of the most damaging to be caught neglecting.
Keep the human at the centre, in writing. State that AI acts in service of, and subordinate to, human judgement — that no degree of machine autonomy dissolves the responsibility of the people who deployed it. This single sentence, placed in the policy, is what prevents the slow drift in which “the system decided” becomes an accepted answer.
Controls
Baseline3 controls
Control 1
Write a one-page AI principles and acceptable-use policy, grounded in named values.
BaselinePreventiveall rolesthe whole organisation
What it is
One page is enough to start; what matters is that it exists, that it states the values, the data red lines, and the autonomy red lines, and that it is enforced.
How to implement it · Minimum structure
Purpose: what the organisation uses AI for
3–5 named principles (e.g. human oversight, data protection, transparency)
Permitted and prohibited uses (e.g. no customer data in unapproved tools; no decisions about people without human review)
Approved tools, by reference to the inventory
Autonomy red lines
Owner and route for questions
Consequences of breaching it
Annual review and signature by management
How to start
Draft it in a one-hour meeting with management and whoever leads AI use, and approve it at the next.
Evidence
The signed policy and a record that staff have read it.
Mode: light / standard / full
light
The owner-manager signs it and it is circulated by email with acknowledgement.
standard
Management approves it, the AI lead owns it, and acknowledgement is collected through the staff onboarding and annual reminder process.
full
The board approves it, a governance lead owns it, and reading is tracked through the training platform with completion reported to management.
Control 2
Document and stabilise any process before automating it with AI.
BaselinePreventiveall rolesthe whole organisation
What it is
Require the written, step-by-step description as a precondition of automation, and keep it as evidence.
How to implement it · Minimum structure
Process name, owner, trigger and expected output
Steps in order: who does what, in what sequence, with which handoffs (a simple diagram is enough)
Inputs, data and systems used at each step
Decision points and exceptions, and who resolves them
Which steps AI would take over and which stay with people
Stability check: the process has run as written for several cycles without undocumented workarounds
How to start
Pick the first process you plan to automate, have the person who runs it walk through it while someone writes the steps down, and correct it until a colleague could follow it.
Evidence
The dated process description, approved before automation started.
Mode: light / standard / full
light
The person who runs the process writes it as a numbered list or simple diagram in a shared document.
standard
A common template is used and the AI Owner checks the description before approving automation.
full
Descriptions live in the organisation's process repository and are a mandatory gate in the AI approval workflow.
Control 3
Adopt an AI-interaction disclosure policy.
BaselinePreventiveall rolesthe whole organisation
What it is
People are told when they are dealing with AI, in every channel where they might be.
How to implement it · Minimum structure
Scope: every channel where people may meet AI — chat, email, phone, web forms, documents, social media
Who is told: customers, users, applicants, staff and other affected people
When: at the start of the interaction, or on the output itself
Standard plain wording per channel (e.g. “This reply was drafted with AI and reviewed by our team”)
Owner of the policy, and a check whenever a new AI channel or use is added
How to start
List the channels where customers or staff could meet AI output today and agree one disclosure sentence for each.
Evidence
The approved policy and screenshots or samples of the disclosure in each channel.
Mode: light / standard / full
light
The owner-manager approves one standard sentence and adds it to the chat window, email signature or document footer.
standard
Channel owners apply the wording and the AI Owner checks it is present at each new deployment.
full
Disclosure is a release criterion for every AI channel, with periodic sampling by the governance function to confirm it appears.
Enhanced4 controls
Control 4
Have the board, or the highest available authority, approve the AI strategy.
EnhancedPreventiveall rolesthe whole organisation
What it is
AI direction is owned at the top, not delegated to the enthusiasm of individual teams.
How to implement it · Steps
Prepare a short strategy paper: purpose of AI use, priority initiatives, linked objectives, risk appetite, budget, red lines
Send it to the board, or the highest available authority, with time to read it before the meeting
Present it at a formal meeting; record questions, changes and the decision in minutes
Record the approved version, approval date and next review date
Re-submit it on any material change and at least annually
How to start
Put the AI strategy on the agenda of the next board meeting, supported by a two-page paper.
Evidence
Board minutes recording the approval and the approved version of the strategy.
Mode: light / standard / full
light
The owner-manager or partners, as the highest authority, sign and date the strategy.
standard
The management committee or board approves it in a minuted meeting, presented by the AI lead.
full
The board approves it on the AI committee's recommendation, with annual re-approval fixed in the board calendar.
Control 5
Tie each AI initiative to explicit business objectives and review whether the value materialises.
EnhancedDetectiveall rolesthe whole organisation
What it is
Value claims are measured against targets the organisation already tracks, on a recurring cycle.
How to implement it · Minimum content
Initiative name, AI Owner and reference to the system in the inventory
Named objective the organisation already tracks (e.g. response time, cost per case, backlog)
Baseline before AI and expected target (e.g. task from 60 to 15 minutes)
Cost: licences, integration work and staff time
Review dates (e.g. at 3 and 12 months) and the actual result measured
Decision after each review: continue, adjust or stop
How to start
For each AI initiative already live, write down the one objective it serves and the current baseline figure for it.
Evidence
The initiative-to-objective table and the dated value-review records.
Mode: light / standard / full
light
The owner-manager keeps the table in a spreadsheet and reviews it twice a year.
standard
Each AI Owner updates their line and management reviews the table at fixed intervals.
full
Value reviews are part of the portfolio management cycle, with figures pulled from existing performance reporting.
Control 6
Define, in writing, how much AI risk leadership accepts.
EnhancedPreventiveall rolesthe whole organisation
What it is
A stated risk appetite is what allows every later approval to be consistent instead of ad hoc.
How to implement it · Minimum structure
Appetite per risk type: harm to people, data exposure, financial loss, legal, reputational
Three levels: accepted, accepted with conditions, never accepted
Thresholds where possible (e.g. no fully automated decisions about people; error rate tolerated in customer-facing output)
Who may accept residual risk at each level
Link to the autonomy and data red lines in the policy
Review annually and after any serious incident
How to start
Hold a session with management to classify five or six real or planned AI uses as acceptable, conditional or unacceptable, and turn the reasons into the statement.
Evidence
The approved risk-appetite statement and approval records that refer to it.
Mode: light / standard / full
light
The owner-manager writes a half-page statement with clear yes, conditional and no examples.
standard
Management approves it and the AI lead applies it in every approval decision.
full
The board approves it within the enterprise risk framework, with measurable tolerances monitored by the risk function.
Control 8
Mark AI-generated synthetic content with machine-readable provenance where it is published or delivered outside the organisation.
EnhancedPreventiveall rolesper system
What it is
Explicit and implicit (metadata) labels on generated text, image, audio and video; the marking travels with the content wherever it is copied or forwarded.
How to implement it · Minimum rules
Content covered: AI-generated text, images, audio and video published or delivered outside the organisation
Visible label suited to the medium (e.g. “Generated with AI” caption, on-image mark, spoken notice)
Machine-readable marking: provenance metadata embedded in the file and, where the tool supports it, an invisible watermark
Apply the marking at generation or export, not by hand afterwards
Do not strip metadata in later editing, compression or publishing steps
Sample published outputs periodically to confirm the marks survive
How to start
Check which generation tools already embed provenance metadata or watermarks, switch the feature on, and test whether the marks survive your publishing channel.
Evidence
The marking configuration and samples of marked outputs.
Mode: light / standard / full
light
Use the provenance and labelling options built into the generation tool and add a visible label by hand where they are missing.
standard
Marking is configured per system by its Technology Owner and checked on samples each quarter.
full
The publishing pipeline enforces marking and verifies it automatically before any content is released.
Advanced1 controls
Control 7
Align the AI strategy with the corporate and digital strategy, and keep them aligned.
AdvancedPreventiveall rolesthe whole organisation
What it is
AI direction is reviewed whenever the wider strategy changes, so the two do not silently diverge.
How to implement it · Steps
Map each AI priority to the corporate and digital objective it supports
Flag AI initiatives with no corporate objective, and corporate goals that rely on AI without an AI plan
Agree review triggers with the strategy owners: any change to corporate or digital strategy, and annual planning
Record each alignment review, its conclusions and the resulting changes
Present the alignment view to the board together with the AI strategy
How to start
Put the three strategies side by side and build a one-page table mapping each AI priority to the corporate and digital objective it serves.
Evidence
The alignment table and records of the reviews held after each strategy change.
Mode: light / standard / full
light
The owner-manager rereads the AI strategy whenever the business plan changes and notes any adjustment.
standard
The AI lead and the strategy owner review alignment in each planning cycle.
full
Strategy planning formally includes an AI alignment step, coordinated by the strategy office and reported to the board.
Evidence
The policy itself; the written process descriptions predating automation; disclosure wording in your channels; board approval minutes; objective-to-initiative mappings and their value reviews; the written risk appetite. Provenance-marking configuration and samples of marked outputs.