Sub-Module 2.4
Building a Small AI Policy
A policy does not need to be long. Anyone in your organization should be able to answer three questions from it: what is allowed, what is not, and who decides.
| Policy Area | Required Decision |
|---|---|
| Approved tools | Which AI tools may be used, by whom, for what? |
| Data rules | What may never be pasted, regardless of tool or setting? |
| Review rules | Which outputs require human approval before action? |
| High-risk uses | Which uses are restricted or prohibited entirely? |
| Logging | What must be recorded, and where? |
| Incident response | What happens after a mistake, leak, or unsafe output? |
| Ownership | Who is accountable for AI-assisted work and its consequences? |
If this AI output disappeared or was proven wrong right now, what is the worst thing that would happen?
This table triages the consequence of a wrong output; the top tier covers inputs that are hazardous in themselves.
| Answer | Risk Level | Action |
|---|---|---|
| Exposure cannot be undone; access cannot be easily revoked. | Prohibited Without Governance | Applies when the input itself is the hazard: secrets, credentials, sensitive personal data, privileged company data, or automated execution authority. Do not paste or connect these unless policy, access controls, and monitoring already exist. See the full Risk Ladder. |
| Irreversible harm — financial loss, legal exposure, safety impact | Critical | Do not proceed without formal controls and documented human approval. |
| Professional, financial, or regulatory consequence | High | Verify with a qualified expert or primary source before acting. |
| Disruption to a team or process, recoverable | Medium | Add a review step before output is acted on. |
| Minor inconvenience, easily corrected | Low | Proceed with standard review. |
NIST AI Risk Management Framework provides a rigorous governance foundation for organizations that need to scale beyond these starting points. See the Appendix for the full citation.
Two Template Kits turn Modules 1 and 2 into ready-to-use documents in Word or PDF: the Individual Kit ($17) for one person using AI tools on their own, and the Team Kit ($37) for anyone responsible for how others use AI.
Compare both Template Kits — from $17 USD →Prices are in US dollars. Outside the US, checkout may show your local-currency equivalent — the amount charged is still the US-dollar price.