AI Governance Policy Builder

Build internal AI governance policies from scratch. Covers acceptable use, model selection, data handling, vendor contracts, compliance mapping, and board reporting.

When to Use

Writing or reviewing internal AI acceptable use policies
Establishing AI governance committees or review boards
Mapping AI usage to regulatory frameworks (EU AI Act, NIST, ISO 42001)
Evaluating vendor AI terms and liability clauses
Preparing board-level AI governance reports

Governance Policy Framework

1. Acceptable Use Policy (AUP)

Every organization running AI needs a written AUP covering:

Permitted Uses

List approved AI tools by department and function
Define data classification tiers (public, internal, confidential, restricted)
Map which data tiers can enter which AI systems
Specify approved vendors vs. shadow AI (employees using personal ChatGPT accounts)

Prohibited Uses

Customer PII in non-SOC2 models without anonymization
Autonomous financial decisions above $[threshold] without human review
HR screening/scoring without bias audit documentation
Any use violating sector regulations (HIPAA, GDPR, SOX, PCI-DSS)

Shadow AI Detection

Signal	Risk Level	Action
API calls to unknown AI endpoints	HIGH	Block + investigate
Browser extensions with AI features	MEDIUM	Audit + approve/deny
Personal accounts on company devices	MEDIUM	Policy reminder + monitor
Exported data to AI training sets	CRITICAL	Immediate review

2. AI Model Selection & Procurement

Evaluation Scorecard (100 points)

Criteria	Weight	What to Check
Data residency & sovereignty	20	Where is data processed? Stored? Can you choose region?
Security certifications	20	SOC2 Type II, ISO 27001, HIPAA BAA, FedRAMP
Model transparency	15	Training data provenance, bias testing, version control
Contract terms	15	Data usage rights, indemnification, SLA, exit clauses
Performance & cost	15	Latency, accuracy benchmarks, token pricing, rate limits
Integration & support	15	API stability, documentation quality, support SLA

Minimum score for production deployment: 70/100

Red Flags (automatic disqualification):

Vendor trains on your data without opt-out
No data processing agreement (DPA) available
Indemnification excluded for AI outputs
No incident response SLA

3. Data Handling & Classification

AI Data Flow Audit Template

For each AI integration, document:

Input data: What goes in? Classification tier? PII present?
Processing: Where? Which model? Hosted or API? Region?
Output data: What comes out? Stored where? Retention period?
Training: Does vendor use your data for training? Opt-out confirmed?
Logging: Are prompts/responses logged? Where? Who has access?
Deletion: Can you request data deletion? Verified how?

Data Minimization Checklist

Only send minimum necessary data to AI systems
Strip PII before processing where possible
Use synthetic data for testing and development
Implement input sanitization for prompt injection prevention
Audit output for data leakage (model regurgitating training data)

4. Regulatory Compliance Mapping

EU AI Act (effective Aug 2025, enforcement Feb 2025)

Risk Category	Examples	Requirements
Unacceptable	Social scoring, real-time biometric ID (most cases)	Banned
High-risk	HR screening, credit scoring, medical devices	Conformity assessment, human oversight, transparency
Limited	Chatbots, deepfakes	Transparency obligations (disclose AI use)
Minimal	Spam filters, game AI	No requirements

NIST AI RMF (Risk Management Framework)

Map: Identify AI systems in use
Measure: Quantify risks per system
Manage: Implement controls proportional to risk
Govern: Establish oversight structure and accountability

ISO 42001 (AI Management System)

Useful for organizations wanting certified AI governance
Aligns with ISO 27001 (already have it? Easier path)
Covers: AI policy, risk assessment, objectives, competence, documentation

5. AI Governance Committee Structure

Recommended Composition

Chair: CTO or Chief AI Officer
Legal: 1 representative (contracts, compliance)
Security: CISO or delegate (data protection, incident response)
Business: 1-2 department heads (use case prioritization)
Ethics: External advisor or designated internal role
Finance: CFO delegate (budget, ROI tracking)

Meeting Cadence

Monthly: Review new AI use cases, vendor changes, incidents
Quarterly: Policy updates, compliance audit, budget review
Annually: Full governance framework review, board report

Decision Authority

Decision	Authority Level
New AI tool (< $5K/year)	Department head + security review
New AI tool (> $5K/year)	Governance committee approval
Customer-facing AI	Committee + legal + CEO sign-off
AI incident response	Security lead (immediate) → Committee (48h review)

6. Vendor Contract Checklist

Before signing any AI vendor contract, confirm:

7. Board Reporting Template

Quarterly AI Governance Report

AI GOVERNANCE REPORT — Q[X] [YEAR]

1. AI PORTFOLIO SUMMARY
   - Active AI systems: [count]
   - New deployments this quarter: [count]
   - Retired/replaced: [count]
   - Total AI spend: $[amount] (vs budget: $[amount])

2. RISK DASHBOARD
   - High-risk systems: [count] — all compliant: [Y/N]
   - Open incidents: [count] — resolved this quarter: [count]
   - Shadow AI detections: [count] — remediated: [count]
   - Compliance gaps: [list]

3. VALUE DELIVERED
   - Hours saved: [estimate]
   - Revenue attributed to AI: $[amount]
   - Cost reduction: $[amount]
   - Customer satisfaction impact: [metric]

4. KEY DECISIONS NEEDED
   - [Decision 1: context + recommendation]
   - [Decision 2: context + recommendation]

5. NEXT QUARTER PRIORITIES
   - [Priority 1]
   - [Priority 2]

8. Incident Response for AI Systems

AI-Specific Incident Categories

Category	Example	Response Time
Data breach via AI	Model leaks PII in output	Immediate — invoke security IR plan
Hallucination causing harm	Wrong medical/legal/financial advice acted on	4h — document, notify affected parties
Bias detected	Discriminatory output in hiring/lending	24h — suspend system, audit, remediate
Prompt injection	Attacker manipulates AI behavior	Immediate — block vector, patch
Cost overrun	Runaway API calls	4h — rate limit, investigate, cap
Vendor incident	Provider breach or outage	Per vendor SLA — activate backup

Post-Incident Review Template

What happened (factual timeline)
Impact (who/what affected, cost, duration)
Root cause (not blame — systems thinking)
Fixes applied (immediate + permanent)
Policy/process changes needed
Board notification required? (Y/N + rationale)

Cost of NOT Having AI Governance

Company Size	Annual Risk Without Governance
15-50 employees	$50K-$200K (shadow AI waste, compliance fines)
50-200 employees	$200K-$800K (data incidents, vendor lock-in, redundant tools)
200-1000 employees	$800K-$3M (regulatory penalties, IP exposure, audit failures)
1000+ employees	$3M-$15M+ (class action, regulatory enforcement, reputational damage)

90-Day Implementation Roadmap

Month 1: Foundation

Draft acceptable use policy
Inventory all AI systems in use (including shadow AI)
Classify data flowing through each system
Identify governance committee members

Month 2: Controls

Finalize and distribute AUP
Implement vendor evaluation scorecard for new purchases
Set up AI incident response procedures
Begin regulatory compliance mapping

Month 3: Operationalize

First governance committee meeting
Deliver first board report
Establish monitoring for shadow AI
Schedule quarterly policy review cycle

Built by AfrexAI — AI operations infrastructure for mid-market companies.

Get the full industry-specific context pack for your sector ($47): https://afrexai-cto.github.io/context-packs/

Calculate your AI automation ROI: https://afrexai-cto.github.io/ai-revenue-calculator/

Set up your AI agent workforce in 5 minutes: https://afrexai-cto.github.io/agent-setup/

Need all 10 industry packs? $197 for the complete bundle: https://buy.stripe.com/aEUaGJ2Xd0rI6zKfZ7