What a Real AI Policy Actually Contains

AI GOVERNANCE

Written by: Devensa Advisory

Only 38% of organizations have a formal, comprehensive AI policy, even though 90% report employees are already using AI tools.Source: ISACA, 2026 AI Pulse Poll

Most organizations that say they have an AI policy have a memo. A real AI policy is a governance instrument: it assigns ownership, sets approval thresholds, defines prohibited uses, and specifies what happens when someone breaks the rules. The distance between those two things is not academic. ISACA’s 2026 AI Pulse Poll of 3,400 digital trust professionals found that 90 percent report employees are already using AI tools, yet only 38 percent of organizations have a formal, comprehensive AI policy in place¹ and one in four have no policy at all.

A Memo Is Not a Policy

A one-page acceptable-use notice tells employees not to paste client data into a public chatbot. That is a start, not a governance program. A real AI policy covers use-case approval (what AI can be deployed, and who signs off before it touches production data), data handling rules specific to AI systems, model and vendor due diligence, human review requirements for consequential decisions, incident response for AI-specific failures, and a review cadence tied to how fast the technology and the regulatory environment are moving.

AI governance is commonly reduced to a single artifact, a single tool, or a single department’s job. It is none of those things. Legal cannot own it alone, because the risks are technical. IT cannot own it alone, because the exposure is legal and reputational. The function that governs AI has to sit across the organization, with the authority to say no to a use case and the standing to be in the room when strategy gets set.

The Gap Is Already Showing Up in the Numbers

The cost of treating AI governance as a formality is measurable, and it is rising.

IBM’s 2025 Cost of a Data Breach Report found that shadow AI, meaning AI tools employees adopt without sanction or oversight, was a contributing factor in one in five breaches globally. Among organizations that suffered an AI-related breach, 97 percent lacked proper AI access controls, and 63 percent had no AI governance policy, or were still developing one². When shadow AI was present, breach costs rose by an average of $670,000, and those breaches took longer to detect and contain than the global average.

Regulation is closing the gap from the other direction. The EU AI Act’s high-risk system obligations phase in through 2026 and 2027, and violations of the Act’s prohibited-practice and high-risk provisions can carry penalties of up to €35 million or 7 percent of global annual revenue³, whichever is higher. That is not a fine schedule a legal department can absorb quietly.

Boards have noticed. The share of S&P 500 companies disclosing at least one material AI risk in their annual filings climbed from 12 percent in 2023 to 72 percent in 2025⁴, a shift that reflects how quickly directors have moved from treating AI as an innovation story to treating it as a risk they are accountable for. Yet McKinsey’s State of AI research found that only 28 percent of organizations put direct AI governance responsibility on the CEO⁵, which leaves a majority of boards asking a question nobody in the room can fully answer: who owns this.

A vCAIO gives that question an answer. As a fractional executive delivered on an hours-pooled retainer, the vCAIO builds and owns the AI policy, sits with the board when AI risk comes up, and makes the trade-off calls between innovation speed and control that a policy document alone cannot make.

The adoption curve is outpacing the governance curve: nine in ten organizations have employees using AI, but fewer than four in ten have a formal policy in place. Source: ISACA, 2026 AI Pulse Poll, via Kiteworks analysis

Two Frameworks Worth Building Around

A written policy earns its authority by tracing back to something recognized outside the organization, not by reading well internally. Two frameworks anchor most credible AI policies today.

NIST AI Risk Management Framework

The NIST AI RMF organizes AI governance into four functions: Govern (culture, accountability, and policy), Map (understanding context and identifying risk), Measure (evaluating and tracking risk with metrics), and Manage (allocating resources to respond to identified risk). A policy that only addresses Govern, meaning it states values without mapping actual use cases or measuring outcomes, is the memo problem restated in framework language.

ISO/IEC 42001

ISO/IEC 42001 is the first international management-system standard built specifically for AI, structured the way ISO 27001 is structured for information security: policy, objectives, risk assessment, controls, and a continual-improvement cycle. Organizations pursuing ISO/IEC 42001 alignment end up building most of the components a real AI policy needs anyway, because the standard forces the same ownership and review questions.

This is where the TruMaturity™ Assessment does its work. The assessment scores AI Governance as one of six domains against the CMMI maturity scale, from Initial through Optimized, so an organization does not have to guess whether its policy is a memo or a governance instrument. The score says so, and the roadmap that follows the assessment lays out exactly what closes the gap.

What Belongs in the Document

Strip away the framework language and a real AI policy answers a short list of practical questions.

Ownership: who approves a new AI use case, and who can revoke that approval.

• Scope: which categories of AI are covered, including generative AI, embedded model features in vendor software, and internally built models.
• Data rules: what data classes can never touch an AI system, and what review happens before a new one is connected.
• Human review: which decisions require a person in the loop before an AI output is acted on.
• Vendor and model due diligence: what a business unit has to document before adopting a third-party AI tool.
• Incident response: how an AI-specific failure, such as a hallucinated output used in a client deliverable, gets reported and remediated.
• Review cadence: a fixed schedule for revisiting the policy against new regulation and new internal use cases.

Where to Start This Quarter

Organizations rebuilding an AI policy from a memo tend to get the most traction from a short sequence, done in order.

1. Inventory actual use, not approved use. Ask business units what AI tools people are already using, not what the IT-approved list says.
2. Assign a single accountable owner for the policy, distinct from whoever owns general IT policy or the code of conduct.
3. Set data-handling rules before use-case rules. Most exposure comes from what touches the model, not from the model itself.
4. Build the human-review requirement around consequence, not around technology. Decisions with material impact on people or the business get a person in the loop, regardless of how the AI was built.
5. Put a review date on the document itself. A policy without a forced revisit date quietly becomes the memo it was trying to replace.

Frequently Asked Questions

What is the difference between an AI policy and an AI acceptable-use notice?

An acceptable-use notice tells employees what not to do with AI tools. A policy is broader: it assigns ownership, sets approval and review processes for new use cases, defines data-handling rules specific to AI systems, and specifies consequences and incident response. The notice is one page inside the policy, not a substitute for it.

Does a small or mid-market organization actually need a formal AI policy?

Yes, and arguably sooner than a large enterprise, because smaller organizations tend to adopt AI tools faster than they build oversight for them. A formal policy scoped to the organization’s actual size and risk profile is achievable in weeks, not quarters.

Is ISO/IEC 42001 certification required to have a credible AI policy?

No. Certification is a separate decision from policy quality. An organization can build a policy that reflects ISO/IEC 42001’s structure, meaning clear ownership, risk assessment, controls, and review cycles, without pursuing formal certification. Certification becomes relevant when customers or regulators require independent verification.

Who should own the AI policy inside the organization?

A single accountable owner, typically a vCAIO or equivalent executive function, who can pull in legal, IT, and business unit leaders as needed. Distributed ownership across departments is the most common reason AI policies stall between drafting and enforcement.

How often should an AI policy be reviewed?

At minimum annually, and sooner when a new regulation takes effect or the organization adopts a materially new category of AI use. The EU AI Act’s phased obligations through 2026 and 2027 are one example of a fixed external trigger worth building into the review calendar. What does your own policy’s review date say, and when was it last checked?

Sources

1. ISACA, 2026 AI Pulse Poll (via Kiteworks analysis) — https://www.kiteworks.com/cybersecurity-risk-management/ai-policy-gap-shadow-ai/

2. IBM, Cost of a Data Breach Report 2025: The AI Oversight Gap — https://www.techrepublic.com/article/news-ai-breach-risks-rise-as-governance-lags/

3. European Union, EU AI Act (Regulation 2024/1689), enforcement timeline summary — https://askajay.ai/thinking/policy-is-not-control-ai-governance-gap

4. S&P 500 AI risk disclosure trend, cited in Corruption, Crime & Compliance — https://blog.volkovlaw.com/2026/06/the-ai-governance-gap-the-urgency-is-now-part-1-of-3/

5. McKinsey, The State of AI survey, CEO ownership of AI governance finding — https://ethicorai.com/newsletter/2025-in-review-the-year-ai-governance-became-non-negotiable

This article is provided for informational purposes only and does not constitute legal or compliance advice. Consult qualified counsel before making governance decisions.