Governance policies and acceptable use
AI Risk &
Policy
AI Risk & Policy is the foundation of any governance program. Before an organization can effectively manage data, security, or compliance risks in AI, it needs a framework that defines who owns those decisions, how AI use cases are approved, and what accountability looks like when something goes wrong.
Why It Matters
Regulators, boards, insurers, and enterprise customers are beginning to demand documented AI governance as a baseline expectation — not an aspirational goal. The EU AI Act requires high-risk AI providers to implement robust risk management systems. NIST AI RMF's Govern function makes policy and accountability the first requirement. Without a formal governance framework, there is no defensible answer to the question every board will eventually ask: "Who owns AI risk here, and how is it managed?"
Regulatory Context
The EU AI Act (effective 2024) requires providers and deployers of high-risk AI systems to implement a documented risk management system. NIST AI RMF Govern 1.0 establishes accountability as the prerequisite for all other risk management functions. ISO 42001 requires an AI management system policy signed by top management.
Key Dimensions
The assessment evaluates AI Risk & Policy across four questions, each targeting a distinct governance dimension:
A documented framework defining acceptable AI use, oversight requirements, prohibited use cases, and consequences for non-compliance — endorsed at the executive or board level and reviewed regularly.
A formal process for evaluating proposed AI projects before deployment, including cross-functional risk assessment with representation from legal, security, compliance, and affected business units.
A comprehensive, current register of all AI systems operating in production — including third-party AI APIs and models — classified by risk level and business impact.
Named roles with defined authority and dedicated resources to execute AI governance activities, from policy enforcement to escalation and exception handling.
What Optimizing Looks Like
An organization scoring in the Optimizing range (76–100) on AI Risk & Policy demonstrates:
- →A formal AI governance policy adopted organization-wide, reviewed at least annually, and endorsed by executive leadership or the board
- →A cross-functional AI review board with documented approval criteria and the authority to halt non-compliant deployments
- →A comprehensive AI inventory with risk classifications, impact assessments, and designated system owners
- →Dedicated governance roles — Chief AI Officer, AI Ethics Officer, or equivalent — with clear authority and board-level accountability
Assessment Questions
The following four questions make up the AI Risk & Policy domain in the assessment. Each is scored 0–3, for a maximum of 12 raw points (normalized to 0–100).
Does your organization have a documented AI governance policy or framework?
How are AI use cases reviewed and approved before deployment?
Does your organization maintain an inventory of AI systems in production?
Are roles and responsibilities for AI governance clearly defined and resourced?
Share This Page
Use this as a conversation starter with prospects or board members.
See how this domain fits into the full assessment → Assessment Methodology