> ## Documentation Index
> Fetch the complete documentation index at: https://help.guardbook.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Policy: what clause 3.2 requires

> Why your firm needs a written AI policy, the four things it must cover as a minimum, and how guardbook generates and versions it.

Clause 3.2 requires firms to develop and implement policies on responsible AI use, informed by the risk register, covering systems the firm develops itself as well as third-party ones.

The policy does not have to be a standalone document. It can sit inside your existing IT, data protection or client engagement policies. What it cannot do is not exist.

## The four minimum contents

> [card] Roles and responsibilities
>
> The roles, responsibilities and liabilities of everyone involved in procuring or using AI. This is where named individuals belong.

> [card] Training expectations
>
> The regular, at least annual, training expected of everyone involved.

> [card] Human control
>
> How human control and judgement interacts with AI use. Monitoring and dip-sampling of outputs are the standard's own examples.

> [card] Risk guidance
>
> How to identify and mitigate risks.

> [!NOTE]
>
> "Informed by the risk register" is a sequencing instruction. The register is meant to shape the policy, not the other way round. If your register is empty when the policy is generated, the policy is thinner than it should be.

## How guardbook handles it

Open **AI Policy** from the left-hand navigation.

Before you have one, you see **No policy generated yet** and a button to generate. Afterwards you see the document itself, with a section rail down the left, a version number, and the date it was generated.

The policy is drafted from your onboarding answers and your current Tool Register, taken at face value. Your firm remains responsible for whether those answers were accurate.

Three actions sit above the document:

* **Download PDF**. The current version as a file. Once adopted, the captured signature is embedded in it.
* **Adopt policy**. Signs and adopts this version. See [adopt and sign](https://help.guardbook.ai/ai-policy/adopting-and-signing.md).
* **Regenerate**. Creates the next version from your current data. See [keeping it current](https://help.guardbook.ai/ai-policy/keeping-it-current.md).

> [!WARNING]
>
> Generating a policy is not adopting one, and an unadopted policy is a draft.
>
> guardbook will happily hold a generated, unadopted policy indefinitely. Clause 3.2 asks firms to develop **and implement** a policy. A document nobody has signed has not been implemented.

## Read it before you sign it

The draft is generated. It reflects what you told the onboarding questionnaire, and questionnaire answers get given quickly.

Read the whole thing before adopting, with particular attention to anything naming a person, describing a control, or committing the firm to a frequency. Those are the clauses you will be held to.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.