AI Governance Policy

ai-governance.md·ISO 42001 · Clause 5

Generate an AI Governance Policy with a named owner, a review gate for new AI use cases, an AI inventory, and the risk register entries enterprise reviewers now ask about.

Generate this policy Browse all policies

What's in the policy

Establishes who owns AI risk, how new AI use cases get reviewed, and what is recorded about them.

✓Named accountable owner for the AI program

✓Review and approval gate for new AI use cases

✓An inventory of approved AI tools, required before use

✓Risk assessment and register entries for AI

✓Human oversight expectations

✓Annual review and change triggers

Mapped toISO 42001NIST AI RMF

What the document actually says

These are the standing requirements every generated copy of the document is written from — the clause text itself, not a description of it. The document you receive is drafted on top of them: it expands on them and fills the current-state detail from your intake, and the generator is instructed to keep them, to state them fully, and never to claim a certification or invent a fact you did not supply.

What has to happen before an AI tool is used at all

- AI tools and services are **inventoried and approved** before use in business or product contexts. - The use of customer or personal data with AI systems is governed by the Data Handling Policy and the AI Vendor Review Policy; **no-training and retention terms are confirmed** before customer data is sent to any AI vendor. - AI outputs that materially affect customers are subject to **appropriate human oversight** — AI does not make unreviewed consequential decisions. - AI systems are assessed for risks including data leakage, bias/fairness, security (e.g., prompt injection), and reliability.

ISO 42001 Clause 5 · NIST AI RMF Govern — nothing gets approved for use until it is inventoried, no-training and retention terms are confirmed before customer data reaches a vendor, and a consequential AI decision is never left unreviewed.

Who is accountable, and what gets recorded

A named owner is accountable for the AI program. New AI use cases involving customer data, or that materially affect customers, are reviewed before launch. AI-related risks are recorded in the risk register and reviewed at least annually.

ISO 42001 Clause 5 · SOC 2 CC1.1 — accountability sits with one named person rather than whichever team happened to ship the feature, and a new use case is reviewed before launch, not after a customer asks about it.

What the company can explain to a customer

Where the product uses AI in a way that affects customers, …is prepared to explain, at an appropriate level, what data is used, which subprocessors are involved, and what human oversight applies.

ISO 42001 Clause 5 · NIST AI RMF Govern — transparency is scoped to three concrete questions a customer actually asks: what data, which subprocessors, and what human check, rather than a general promise to be open about AI.

OpenAI (support) + Anthropic (in-product assistant)

Filled in for a real stack

Placeholder

AI tools used: To be confirmed. AI features in product: To be confirmed. Customer data sent to AI tools: To be confirmed. Human review of AI outputs: To be confirmed.

Resolved

AI tools used: OpenAI's API for internal support-ticket triage. AI features in product: an Anthropic-powered assistant that summarizes account activity for customers. Customer data sent to AI tools: ticket text and account metadata, not payment details. Human review of AI outputs: a support lead checks every AI-drafted summary before a customer sees it.

What the auditor asks for alongside it

A current inventory of the AI tools and product features actually in use, not a description of a policy.

The AI Usage Inventory, generated from the same aiToolsUsed and aiFeaturesInProduct answers this policy's Current AI usage section prints. Internal tools become a name-and-purpose table when entered one per line; product features render as the plain text you gave — two documents built from the same two fields.

What the company is prepared to tell a customer about its AI use, not what it tells itself internally.

The AI Governance Summary for Customers — the outward-facing document the Transparency section commits to being able to produce. It restates the same product-features, customer-data, and human-review answers in customer-safe language. No competitor pairs an internal AI governance policy with a document written for the customer side of that conversation, because no competitor generates one.

Where customer data actually crosses into a model, drawn rather than described.

The system architecture diagram. When the customer-data-to-AI answer reads affirmatively, an 'AI Subprocessors' group appears on the drawing, connected to the product by an edge marked 'customer data' — so 'human oversight applies' and 'inventoried and approved' stop being sentences a reviewer has to take on faith and become a boundary they can actually see.

How a customer's own AI question gets answered on a security questionnaire, and what backs the answer.

The drafted response to 'Do you use AI tools?'. It resolves to the AI-tools-usage topic rather than a blank field, and — like every drafted questionnaire answer — the deterministic baseline behind it is built to carry its own evidence source and review flag: citing the AI Usage Inventory and this policy when aiToolsUsed or aiFeaturesInProduct carry an answer, and flagging itself for review when neither does.

Where these documents go stale

An AI governance policy goes stale the moment a team adopts a tool outside the review gate it describes. A support engineer connects a transcription add-on to the ticketing system; a product manager wires a summarisation call into a feature the same afternoon it is prototyped — neither passes through the 'inventoried and approved before use' clause, because nobody thought of it as an AI decision at the time. The named owner accountable for the program turns over like any other role, and the risk register keeps the AI entries from a use case that shipped eighteen months ago while missing the one that shipped last week. The human-oversight clause ages the same way: a reviewer gets reassigned, and the review step quietly becomes a formality nobody actually performs. Re-validate by walking every AI-touching feature and tool actually in use against the inventory, not by re-reading the policy.

From intake to enterprise-ready in three moves

Tell us about your stack

Answer a short intake — cloud, data types, tools. No agents to install.

We generate a tailored draft

Not a blank template: a document written for your environment and pre-mapped to controls.

Review, edit, and share

Export it or attach it straight to an enterprise security review or questionnaire.

AI Governance Policy, answered

What is an AI governance policy?

An AI governance policy states who is accountable for how a company adopts and uses artificial intelligence — a named owner, a review gate for new AI use cases, an inventory of approved tools, and what gets recorded when something goes into the risk register. It is the umbrella document the other two AI policies sit under.

Why are customers suddenly asking for this?

Security questionnaires have added AI-specific questions, and a reviewer wants to know a named person is accountable for AI decisions rather than the capability having appeared without anyone approving it. A governance policy naming that owner and the review gate behind new use cases is the shortest credible answer.

We only use a third-party model API. Do we still need one?

Usually yes. The question a reviewer is actually asking is what your data does once it reaches that provider and who approved sending it there — a governance question, not a model-building one. Owning no infrastructure does not remove the decision about whether customer data should reach a vendor at all.

How is this different from the AI Acceptable Use Policy?

This document is the program: the named owner, the review gate for a new use case, and the risk register entry. The AI Acceptable Use Policy is the staff-facing rulebook that follows from it — which tools are approved and what data may go into them day to day. One sets the process; the other is what an individual actually follows.

How is this different from the AI Vendor Review Policy?

This document covers the program overall — ownership, the review gate, and what gets recorded about AI use generally. The AI Vendor Review Policy is one step inside that program: the specific criteria, such as training use and retention, a vendor is checked against before it is approved at all.

What counts as a new AI use case that needs review?

Anything involving customer data, or anything that materially affects a customer's experience of the product — a new model swapped into an existing feature counts as much as a feature built from scratch. The trigger is the effect on data or customers, not whether the underlying code changed a lot.

How does Pentest Today generate the policy?

Answer a short intake about your stack and we generate a tailored draft — not a blank template — pre-mapped to the controls your framework requires. You review, edit, and export it.

Can I edit the generated policy?

Yes. Every document is a starting draft you can edit, brand, and export. It's written to be review-ready but stays fully under your control.

Free · no account

Start your Pentest

Our agent swarm and human experts test your endpoints and deliver an audit, fast.

Start your Pentest How it works

Generate your full security policy pack.

Get the ai governance policy plus everything else an enterprise security review asks for — generated from your real environment.

Get started Browse all policies