Skip to main content

​
What the draft is built from

Two sources:
  • your onboarding questionnaire answers
  • your current Tool Register
Nothing else. guardbook does not know anything about your firm that you have not told it, and it takes what you told it at face value.
Order matters, and it is easy to get wrong.Generate the policy before your Tool Register is populated and the policy describes a firm using no tools. Generate it before your Risk Register exists and it is not informed by the register, which is what clause 3.2 asks for.Get the registers in order first. Generate second.

​
Generating

Open AI Policy. If you have no policy yet you will see No policy generated yet and a button to generate one. It takes a moment, then the document appears as Version 1. The first time you open it, a panel explains where the policy came from and when to regenerate it. You can dismiss it once you have read it.

​
What to check before you adopt

Work through the document with the section rail on the left. Five things repay the attention:
Roles, the AI Oversight Lead, whoever the policy says is accountable. Clause 3.2 requires roles and responsibilities to be clear, and a policy naming someone who left is worse than one naming nobody.
Training intervals, review cycles, monitoring cadences. Every frequency in the policy is a commitment your firm has to be able to evidence. If the policy says quarterly and you manage twice a year, change the policy or change the practice.
Cross-check against your Tool Register. Missing tools mean the register was incomplete when you generated.
Clause 3.1 is strict about uploading private and confidential data to AI systems. Make sure the policy reflects what your firm actually does, not what it intends to do.
This is where the policy tells your own staff how to behave. If it is vague, your staff will be vague, and the Oversight Log entries they write will show it.

​
Then adopt it

An unadopted policy is a draft. Adopt and sign covers what happens next.
Nothing stops you regenerating before adopting. If you spot that your Tool Register was incomplete, fix the register and regenerate rather than adopting a policy you already know is wrong.