Strategy: Align · Add-on
Set up AI governance and policy
Using AI safely needs clear rules: who approves AI uses, how risks are assessed and how people stay in control. Set them up before AI spreads across the organisation.
About 5-15 daysChanges yearlyLast reviewed 5 November 2026
Who this applies to
- Skills it builds
- Strategy and visionTechnical and AI fluencyLeadership and coaching
- PM types
- AI
- Product types
- Data or AI product
- Starting points
- All
- Ways of working
- All
- Experience
- All
- Size of organisation
- All
Steps, by experience
Beginner (under 1 year)
- Find out what AI rules your organisation already has.
- Agree who approves new AI uses.
- Set a simple risk check for each new use, including personal data.
- Decide where human review is required.
- Publish the rules in plain language.
Intermediate (1 to 4 years)
- Use a recognised risk framework to shape the checks.
- Require a data protection impact assessment where personal data is used.
- Keep a register of AI uses and their owners.
Experienced (5+ years)
- Set AI policy across the organisation with legal and security leaders.
- Review the policy as rules and technology change.
- Report AI risks to senior leaders regularly.
Who can do this
Owner: Product manager
Can be delegated to
- Policy / Legal / Compliance: Draft the policy and risk checks
- Data Scientist / ML Engineer: Advise on technical risks
Reviewed by: Policy / Legal / Compliance, Senior leader / sponsor
Tool examples
- Confluence
- Publish the AI policy and the register of AI uses.
- Jira
- Track approvals for new AI uses.
Definition of done
- Approval route agreed
- Risk check in place
- Register of AI uses started
- Policy published
Common pitfalls
- Rules nobody can follow
- No owner for each AI use
- Ignoring personal data