Building an AI policy framework that works in practice.
Effective AI governance rarely comes from a single document. AI affects many parts of an organisation, from employee productivity tools and procurement decisions to customer-facing systems, automated decisions, data processing, software development and third-party technology.
A practical governance framework therefore needs a connected set of policies, standards, procedures and supporting controls that define how different types of AI activity should be managed.
The organisation-wide AI policy normally sits at the centre of this structure. It establishes the principles, scope, responsibilities and minimum requirements that apply across the organisation.
Supporting policies then provide more detailed rules for particular areas such as employee use of generative AI, AI procurement, data protection, system development, risk assessment, human oversight, monitoring, incidents and assurance.
Where appropriate, these policies should connect directly to existing organisational frameworks covering information security, data protection, risk management, procurement, technology, records management, HR, legal review, compliance, audit and business continuity.
Policies should also distinguish between different levels of AI risk. A low-impact productivity tool used to draft internal content should not necessarily be governed in the same way as an AI system influencing employment, access to services, financial decisions, safety-critical operations or significant customer outcomes.
This is why policy design should be supported by an AI inventory, clear ownership, risk classification, approval routes and defined lifecycle controls.
The policy library below is therefore structured around the main governance capabilities organisations need to establish as AI becomes embedded across everyday work and enterprise systems.
Organisations do not necessarily need every policy on day one. The objective is to build a proportionate policy architecture that is understandable, enforceable and aligned with how AI is actually being used.
