Governance
Whether you've decided who approves AI use, what's off limits and how risk gets reviewed.
Do you have a written policy on using AI?
Why it matters: Staff are likely already trying AI tools, so they need clear rules.
A first step: Publish a one-page AI policy covering approved tools, banned data and human review.
Who approves a new AI tool or use?
Why it matters: Without an approver, risk decisions get made by default.
A first step: Name one accountable person and a short review checklist for new AI tools.
Do people check AI output before it affects a customer or decision?
Why it matters: Human review is the most direct control over AI mistakes.
A first step: Define which AI outputs need a person's sign-off before they're used, and record who signed off.