Board AI Governance Policy (One-Page)
A one-page, board-level statement of how the organization governs its adoption of AI. It sets the stance (risk-tier, not ban-or-allow), the use-case tiers, the approval workflow, the data-handling rules, and who owns AI risk. Adopt and adapt it with your legal, privacy and security leaders.
01Principles & scope
This policy governs the evaluation, approval and use of artificial intelligence — including generative AI and third-party AI services — across Organization. It applies to all staff, contractors and systems that use AI on company data or on behalf of the company.
- Proportionate, not prohibitionist: AI use is governed by risk-tiering use cases, not by a blanket ban or a blanket allow.
- Data sets the tier: the sensitivity of the data and the impact of the use decide which model tier and controls apply.
- A sanctioned path exists: approved tools and clear rules make the safe option the easy one, so AI use stays visible rather than going underground.
- A human stays accountable: consequential, customer-affecting or regulated decisions keep meaningful human oversight.
- Honest alignment: the program aligns to recognized frameworks and tracks emerging law, without claiming certification or compliance it has not earned.
Scope note: name the AI systems, business units and data types in scope, and reference any adjacent policies (acceptable use, data classification, vendor risk, privacy).
02Use-case risk tiers
Every AI use case is classified into one of three tiers. The tier sets the approval required and the controls that apply before use.
| Tier | Examples | Approval required | Controls |
|---|---|---|---|
| Prohibited | Secrets/credentials or regulated data into public consumer models; fully automated consequential decisions with no human review; uses that are unlawful or unethical | Not permitted | Blocked; exceptions only by the governance body with documented justification |
| High-risk | Customer-facing AI; hiring, pricing, lending, eligibility or other decisions about people; new external AI vendor touching sensitive data; novel or large-scale deployments | AI governance body review + sign-off before launch | Risk assessment, bias/accuracy/explainability testing, human-in-the-loop, vendor due diligence, logging |
| Standard | Internal productivity and drafting on non-sensitive data using approved enterprise tools | Self-serve within policy (no case-by-case sign-off) | Approved tool + data-handling rules + usage logging |
Urgency and executive enthusiasm are not a tier. A flashy, high-visibility pilot is high-risk by definition and goes through review — fast-tracked if needed, never skipped.
03Approval workflow
A new or materially changed AI use case follows this path before it goes live.
- Request — the requester describes the use case, the data it touches, the tool/model, and the intended output and decision.
- Risk-tier — classify the use case as prohibited, high-risk or standard using the table above.
- Review — standard uses proceed under policy; high-risk uses go to the AI governance body for assessment (data, vendor, bias/accuracy, human oversight).
- Decision — approve (with conditions), deny, or return for changes; record the rationale and the owner.
- Logging — enter the use case in the AI inventory with its tier, approver, data flows and date; keep usage logs for audit and incident response.
04Data-handling rules
What may go into which model tier is set by data classification. When in doubt, treat data as more sensitive, not less — once data leaves in a prompt, it cannot be recalled.
| Data type | Public consumer AI | Approved enterprise / no-train tier |
|---|---|---|
| Public / non-sensitive | Permitted | Permitted |
| Internal / confidential (incl. source code, strategy) | Not permitted | Permitted under contract terms |
| Personal data (PII) | Not permitted | Permitted only with privacy review |
| Regulated / special-category (health, financial, etc.) | Prohibited | Permitted only with no-training, defined retention/deletion and data-residency terms |
| Secrets / credentials | Prohibited | Prohibited |
- Use only approved tools; do not use personal accounts for company work.
- Prefer enterprise tiers with contractual no-training, defined retention/deletion and sub-processor transparency over consumer click-through terms.
- Treat AI output as draft: review it for accuracy, bias, confidentiality and IP/infringement before relying on or publishing it.
- Disclose AI involvement where people are affected, as policy or law requires.
05Oversight & ownership
AI risk owner
Cross-functional AI governance body — legal, security, risk, data, privacy, business — not IT alone
Executive accountability
Named executive sponsor accountable to the board
Board oversight cadence
e.g. quarterly reporting on AI inventory, high-risk uses, incidents and framework progress
Framework alignment
NIST AI RMF · ISO/IEC 42001 · EU AI Act risk tiers — aligned to, not certified
- Maintain the AI inventory and keep approvals, data flows and usage logs current
- Report to the board on a set cadence — inventory, high-risk and customer-facing uses, incidents and near-misses, framework progress
- Review the policy at least annually and when the law, tooling or risk profile changes
- Map use cases to EU AI Act risk categories; follow NIST AI RMF / ISO 42001 practices
- State alignment honestly — do not claim certification or compliance the program has not earned
Educational template — not legal or compliance advice. The framework and legal references are summarised for orientation and can change; adapt this with qualified counsel. This one-pager is deliberately light; for the detailed, control-by-control artifact see the PlayCISO AI Governance Policy Pack (/tools/ai-governance-pack).