Skip to main content
Clause 3.2 requires firms to develop and implement policies on responsible AI use, informed by the risk register, covering systems the firm develops itself as well as third-party ones. The policy does not have to be a standalone document. It can sit inside your existing IT, data protection or client engagement policies. What it cannot do is not exist.

​
The four minimum contents

Roles and responsibilities

The roles, responsibilities and liabilities of everyone involved in procuring or using AI. This is where named individuals belong.

Training expectations

The regular, at least annual, training expected of everyone involved.

Human control

How human control and judgement interacts with AI use. Monitoring and dip-sampling of outputs are the standard’s own examples.

Risk guidance

How to identify and mitigate risks.
“Informed by the risk register” is a sequencing instruction. The register is meant to shape the policy, not the other way round. If your register is empty when the policy is generated, the policy is thinner than it should be.

​
How guardbook handles it

Open AI Policy from the left-hand navigation. Before you have one, you see No policy generated yet and a button to generate. Afterwards you see the document itself, with a section rail down the left, a version number, and the date it was generated. The policy is drafted from your onboarding answers and your current Tool Register, taken at face value. Your firm remains responsible for whether those answers were accurate. Three actions sit above the document:
  • Download PDF. The current version as a file. Once adopted, the captured signature is embedded in it.
  • Adopt policy. Signs and adopts this version. See adopt and sign.
  • Regenerate. Creates the next version from your current data. See keeping it current.
Generating a policy is not adopting one, and an unadopted policy is a draft.guardbook will happily hold a generated, unadopted policy indefinitely. Clause 3.2 asks firms to develop and implement a policy. A document nobody has signed has not been implemented.

​
Read it before you sign it

The draft is generated. It reflects what you told the onboarding questionnaire, and questionnaire answers get given quickly. Read the whole thing before adopting, with particular attention to anything naming a person, describing a control, or committing the firm to a frequency. Those are the clauses you will be held to.