AI Governance Policy Builder

Build internal AI governance policies from scratch. Covers acceptable use, model selection, data handling, vendor contracts, compliance mapping, and board reporting.

When to Use

• Writing or reviewing internal AI acceptable use policies
• Establishing AI governance committees or review boards
• Mapping AI usage to regulatory frameworks (EU AI Act, NIST, ISO 42001)
• Evaluating vendor AI terms and liability clauses
• Preparing board-level AI governance reports

Governance Policy Framework

1. Acceptable Use Policy (AUP)

Every organization running AI needs a written AUP covering:

Permitted Uses

• List approved AI tools by department and function
• Define data classification tiers (public, internal, confidential, restricted)
• Map which data tiers can enter which AI systems
• Specify approved vendors vs. shadow AI (employees using personal ChatGPT accounts)

Prohibited Uses

• Customer PII in non-SOC2 models without anonymization
• Autonomous financial decisions above $[threshold] without human review
• HR screening/scoring without bias audit documentation
• Any use violating sector regulations (HIPAA, GDPR, SOX, PCI-DSS)

Shadow AI Detection

2. AI Model Selection & Procurement

Evaluation Scorecard (100 points)

Minimum score for production deployment: 70/100

Red Flags (automatic disqualification):

• Vendor trains on your data without opt-out
• No data processing agreement (DPA) available
• Indemnification excluded for AI outputs
• No incident response SLA

3. Data Handling & Classification

AI Data Flow Audit Template

For each AI integration, document:

1. Input data: What goes in? Classification tier? PII present?
2. Processing: Where? Which model? Hosted or API? Region?
3. Output data: What comes out? Stored where? Retention period?
4. Training: Does vendor use your data for training? Opt-out confirmed?
5. Logging: Are prompts/responses logged? Where? Who has access?
6. Deletion: Can you request data deletion? Verified how?

Data Minimization Checklist

• Only send minimum necessary data to AI systems
• Strip PII before processing where possible
• Use synthetic data for testing and development
• Implement input sanitization for prompt injection prevention
• Audit output for data leakage (model regurgitating training data)

4. Regulatory Compliance Mapping

EU AI Act (effective Aug 2025, enforcement Feb 2025)

NIST AI RMF (Risk Management Framework)

• Map: Identify AI systems in use
• Measure: Quantify risks per system
• Manage: Implement controls proportional to risk
• Govern: Establish oversight structure and accountability

ISO 42001 (AI Management System)

• Useful for organizations wanting certified AI governance
• Aligns with ISO 27001 (already have it? Easier path)
• Covers: AI policy, risk assessment, objectives, competence, documentation

5. AI Governance Committee Structure

Recommended Composition

• Chair: CTO or Chief AI Officer
• Legal: 1 representative (contracts, compliance)
• Security: CISO or delegate (data protection, incident response)
• Business: 1-2 department heads (use case prioritization)
• Ethics: External advisor or designated internal role
• Finance: CFO delegate (budget, ROI tracking)

Meeting Cadence

• Monthly: Review new AI use cases, vendor changes, incidents
• Quarterly: Policy updates, compliance audit, budget review
• Annually: Full governance framework review, board report

Decision Authority

6. Vendor Contract Checklist

Before signing any AI vendor contract, confirm:

• Data processing agreement (DPA) signed
• Your data is NOT used for model training (or explicit opt-out confirmed)
• Data residency requirements met (specify regions)
• Indemnification clause covers AI-generated output liability
• SLA includes uptime, latency, and support response time
• Exit clause: data export format, deletion timeline, transition support
• Security certifications current and verified (not expired)
• Incident notification timeline specified (72h or less)
• Subprocessor list provided with change notification rights
• Insurance coverage for AI-specific risks confirmed
• Price lock or cap on increases for contract duration
• Right to audit (or audit report access)

7. Board Reporting Template

Quarterly AI Governance Report

AI GOVERNANCE REPORT — Q[X] [YEAR]

1. AI PORTFOLIO SUMMARY
   - Active AI systems: [count]
   - New deployments this quarter: [count]
   - Retired/replaced: [count]
   - Total AI spend: $[amount] (vs budget: $[amount])

2. RISK DASHBOARD
   - High-risk systems: [count] — all compliant: [Y/N]
   - Open incidents: [count] — resolved this quarter: [count]
   - Shadow AI detections: [count] — remediated: [count]
   - Compliance gaps: [list]

3. VALUE DELIVERED
   - Hours saved: [estimate]
   - Revenue attributed to AI: $[amount]
   - Cost reduction: $[amount]
   - Customer satisfaction impact: [metric]

4. KEY DECISIONS NEEDED
   - [Decision 1: context + recommendation]
   - [Decision 2: context + recommendation]

5. NEXT QUARTER PRIORITIES
   - [Priority 1]
   - [Priority 2]

8. Incident Response for AI Systems

AI-Specific Incident Categories

Post-Incident Review Template

1. What happened (factual timeline)
2. Impact (who/what affected, cost, duration)
3. Root cause (not blame — systems thinking)
4. Fixes applied (immediate + permanent)
5. Policy/process changes needed
6. Board notification required? (Y/N + rationale)

Cost of NOT Having AI Governance

90-Day Implementation Roadmap

Month 1: Foundation

• Draft acceptable use policy
• Inventory all AI systems in use (including shadow AI)
• Classify data flowing through each system
• Identify governance committee members

Month 2: Controls

• Finalize and distribute AUP
• Implement vendor evaluation scorecard for new purchases
• Set up AI incident response procedures
• Begin regulatory compliance mapping

Month 3: Operationalize

• First governance committee meeting
• Deliver first board report
• Establish monitoring for shadow AI
• Schedule quarterly policy review cycle

Built by AfrexAI — AI operations infrastructure for mid-market companies.

Get the full industry-specific context pack for your sector ($47): https://afrexai-cto.github.io/context-packs/

Calculate your AI automation ROI: https://afrexai-cto.github.io/ai-revenue-calculator/

Set up your AI agent workforce in 5 minutes: https://afrexai-cto.github.io/agent-setup/

Need all 10 industry packs? $197 for the complete bundle: https://buy.stripe.com/aEUaGJ2Xd0rI6zKfZ7