Skip to content

AI Security

AI governance and policy

What this is

AI governance and policy establishes who inside an organisation is accountable for artificial intelligence decisions, what staff may and may not do with AI tools, and how a deployment gets approved. It produces a written acceptable use standard, a named accountable owner, an approval path, and the decision record that later serves as evidence.

The problem

The question is not whether you have an AI policy. It is who signs off, and what happens if they say no.

Most AI policies fail in one of two directions. Either they are so restrictive that staff route around them onto personal accounts, which removes the only visibility you had. Or they are so vague that they permit everything and answer nothing - the deployment goes ahead because the policy did not say it could not.

A policy only does work when it is attached to a decision. Somebody has to own AI risk by name. There has to be a point in the release process where an AI deployment is reviewed. And whoever holds that review has to have the authority to stop it, or it is a formality that generates paperwork and changes nothing.

The evidence is the other half. When a customer, an auditor or a regulator asks who approved a system and on what basis, the answer needs to be a record rather than a recollection. That record is the entire practical value of governance, and it only exists if the approval step was real.

Who this is for

  • Organisations where AI is in production and no one person owns the risk.
  • Teams whose acceptable use policy predates generative AI and does not mention it.
  • Companies where legal has started asking who authorised a specific AI deployment.
  • Firms preparing for ISO 42001, where allocated responsibility across the AI lifecycle is an explicit requirement.
  • Anyone whose staff are demonstrably using consumer AI tools on company data.

Delivery

How the engagement actually runs

Sprints inside your engineering cycle, with findings arriving continuously rather than a report arriving at the end. Durations are elapsed time for a typical scope, and get re-scoped against your estate before anything is committed.

  1. 011 week

    Current position

    What policies exist, what AI is in use, and where decisions are actually being made today - which is rarely where the org chart says.

  2. 022 weeks

    Draft

    Policy and acceptable use drafted against your operating model, reviewed with engineering and legal together rather than sequentially.

  3. 031-2 weeks

    Wire in the gate

    The approval step built into the existing release process, tiered by risk so low-impact systems pass through quickly.

  4. 042 weeks, then ongoing

    Roll out and operate

    Guidance delivered to the teams who need it, first real approvals run with us alongside, then handed over.

Deliverables

What you actually receive

Artefacts your team owns and can maintain after the engagement, not a report that ages the moment it lands.

Deliverables for AI governance and policy, with what each one contains and when it lands
DeliverableWhat it containsWhen
AI acceptable use standardWhat staff may do with AI tools, what needs approval, and what is prohibited - written in plain language, with the reasoning, because a rule without a reason gets ignored.Week 2
Responsible AI policyThe organisation's position on fairness, transparency, human oversight and contestability, at a level the board can approve and a regulator can read.Week 3
Accountability matrixNamed owners across the AI lifecycle - who proposes, who assesses, who approves, who monitors, and who can stop a deployment.Week 3
Approval workflowThe actual gate, sized by risk tier, sitting inside your existing release process rather than beside it.Week 4
Decision record templateWhat gets captured at approval so the record answers the questions an auditor will ask, without becoming a form nobody completes.Week 4
Staff guidance and rolloutShort, role-specific guidance plus a session with the teams who use AI daily, because a policy that is only emailed is a policy nobody read.Week 5-6

Frameworks this touches

FAQ

Questions people actually ask

What should an AI acceptable use policy cover?

At minimum: which AI tools are approved and how to request others, what categories of data may never be entered into an external AI service, the rules for AI-generated code entering the codebase, disclosure requirements when AI output reaches a customer, and the requirement for human review before an AI output drives a decision affecting a person. It should also say what happens if someone gets it wrong, because a policy with no stated consequence is guidance.

Who should own AI risk in an organisation?

A single named individual with enough seniority to stop a deployment, supported by a cross-functional group. In practice this is usually the CISO, the CTO, a Chief Data Officer or a vCISO. Spreading ownership across a committee is the common failure - auditors and regulators ask who is accountable, and 'the AI working group' is not an answer that survives the follow-up question.

Do we need a separate AI policy or can we extend our existing ones?

Extending existing policies works for the parts that are genuinely the same: data handling, access control and acceptable use of company systems. It does not cover the parts that are new - human oversight of automated decisions, model provenance, output disclosure and contestability. Most organisations end up with an AI-specific standard that references the existing policy set rather than duplicating it.

How do we stop staff using consumer AI tools on company data?

Technical controls help - blocking known endpoints, enterprise agreements with data protections, DLP on obvious patterns - but the durable answer is providing a sanctioned tool that is genuinely good enough. Shadow AI is overwhelmingly driven by people trying to do their jobs faster. Where a permitted alternative exists and works, usage moves to it; where it does not, blocking pushes the same behaviour onto personal devices where you cannot see it at all.

More in AI Security

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours