Minimum Policy Set for AI Use

Yes, as a working minimum. Acceptable use, data protection standards, vendor evaluation, incident reporting and an AI tool register are the floor. Together they let you answer the questions that actually come up in week one of AI adoption: is this tool allowed, can it touch personal data, who approved it, what do we do if it goes wrong. A larger policy framework is appropriate later, especially if you are pursuing ISO 42001 or operating in a regulated sector, but starting with all seventeen documents at once is how programmes stall before they ship.

A focused four-week effort is enough for most organisations. Weeks one and two are stakeholder workshops to agree scope and ownership. Week three is board or leadership sign-off. From week four onwards, you brief staff, register the tools already in use, and start the ongoing review cycle. The bottleneck is usually not drafting; it is getting the right people in the room to agree what is permitted and who owns each document. Treat that as a project with a sponsor, not a side task.

You accept four risks knowingly: shadow AI deployment, data leaking through unreviewed tools, compliance gaps under UK GDPR, and reputational exposure when something goes publicly wrong. Each of these has a real probability over a twelve-month horizon, and the cost of recovery is higher than the cost of writing the policy. The other consequence is cultural: without a policy, staff make their own decisions, those decisions vary, and the leadership team has no consistent picture of how AI is being used.

Owned by the business, maintained with IT input. The register has to capture every AI tool in use, including supplier-embedded AI inside platforms IT did not procure as AI products. Each entry needs a business owner who can say what the tool does, what data it touches and when it was last reviewed. IT contributes the technical detail and helps with discovery, but if IT owns the register alone it tends to miss the SaaS and embedded AI. The board sees the register, not the underlying spreadsheet.

It is the logical first step. ISO/IEC 42001 is the international management system standard for AI, and the minimum policy set covers most of the foundational documents the standard expects you to have. Putting the five documents in place gets you a defensible governance baseline now and shortens the gap if you decide to pursue ISO 42001 certification later. Going straight for ISO 42001 without the minimum set in place is usually slower, because the standard assumes you already have working policies to assess.

The acceptable use policy should cover it explicitly. Staff use of public tools - ChatGPT, Claude, Gemini, transcription apps, image generators - is where most data leakage incidents start. The policy should name which categories of tool are permitted, what data is never to be entered into a public tool, and what the approval route is for new tools. A separate staff-facing acceptable use document, written in plain English and no longer than two pages, usually does more to reduce risk than a 30-page corporate policy nobody reads.