> ## Documentation Index
> Fetch the complete documentation index at: https://help.guardbook.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Generating your firm's AI policy

> What guardbook uses to draft your policy, what to check before adopting it, and why the order you do things in matters.

## What the draft is built from

Two sources:

* your **onboarding questionnaire answers**
* your **current Tool Register**

Nothing else. guardbook does not know anything about your firm that you have not told it, and it takes what you told it at face value.

> [!WARNING]
>
> Order matters, and it is easy to get wrong.
>
> Generate the policy before your Tool Register is populated and the policy describes a firm using no tools. Generate it before your Risk Register exists and it is not informed by the register, which is what clause 3.2 asks for.
>
> Get the registers in order first. Generate second.

## Generating

Open **AI Policy**. If you have no policy yet you will see **No policy generated yet** and a button to generate one. It takes a moment, then the document appears as Version 1.

The first time you open it, a panel explains where the policy came from and when to regenerate it. You can dismiss it once you have read it.

## What to check before you adopt

Work through the document with the section rail on the left. Five things repay the attention:

> [accordion] Anything naming a person
>
> Roles, the AI Oversight Lead, whoever the policy says is accountable. Clause 3.2 requires roles and responsibilities to be clear, and a policy naming someone who left is worse than one naming nobody.

> [accordion] Any stated frequency
>
> Training intervals, review cycles, monitoring cadences. Every frequency in the policy is a commitment your firm has to be able to evidence. If the policy says quarterly and you manage twice a year, change the policy or change the practice.

> [accordion] The tools it describes
>
> Cross-check against your Tool Register. Missing tools mean the register was incomplete when you generated.

> [accordion] Anything about client data
>
> Clause 3.1 is strict about uploading private and confidential data to AI systems. Make sure the policy reflects what your firm actually does, not what it intends to do.

> [accordion] The human oversight section
>
> This is where the policy tells your own staff how to behave. If it is vague, your staff will be vague, and the Oversight Log entries they write will show it.

## Then adopt it

An unadopted policy is a draft. [Adopt and sign](https://help.guardbook.ai/ai-policy/adopting-and-signing.md) covers what happens next.

> [!NOTE]
>
> Nothing stops you regenerating before adopting. If you spot that your Tool Register was incomplete, fix the register and regenerate rather than adopting a policy you already know is wrong.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.