AAIR lesson 3: AI policy and regulation

An AI policy states what people may and must do with AI, procedures say how to do it, and training makes sure people know both; regulations, standards and frameworks then supply the outside expectations the policy has to meet. These two ISACA headings, policies, procedures and organisational training (1D) and regulatory compliance and legal considerations (1E), belong together because a policy is the way an organisation turns external duties into internal rules.

What belongs in an AI policy

A policy is short, approved by senior management and stable; procedures beneath it change more often. A workable AI policy covers:

• Scope and definitions: which systems count, including AI built in-house, bought, or embedded in other tools.
• Acceptable use: what staff may do with AI tools, which data may never be entered into external tools and which uses are prohibited.
• Approval and classification: how a use case is risk-classified and who approves each class.
• Data and third parties: what data may train models, and due diligence on external AI.
• Human oversight and accountability: which decisions need review and who is accountable.
• Monitoring, incidents and exceptions: how problems are reported and how deviations are approved.

The sequence matters. An organisation that does not know which AI it uses cannot write a policy that fits, so an inventory comes before a detailed policy. A policy is also a design control: it shows intent, but compliance has to be evidenced separately.

Training: audiences, not one course

A single generic course is a weak control, because roles face different risks.

Laws, standards and frameworks are different things

Risk professionals separate the instruments by binding force.

The EU AI Act sorts AI systems into risk tiers: unacceptable risk (prohibited practices), high risk (strict obligations such as risk management, data quality, documentation, logging and human oversight), transparency risk (disclosure duties, for example telling people they are interacting with AI) and minimal risk. The NIST framework is organised around four functions, Govern, Map, Measure and Manage, and is voluntary. ISO/IEC 42001 specifies an AI management system that an accredited auditor can certify. These are examples of how an organisation might structure its work, not a required set. The Act’s application dates have already been amended once, so check the current text of the regulation and take legal advice for real obligations. The topic page on AI governance and risk compares the three.

No framework or certificate by itself proves legal compliance. Compliance is assessed against the applicable law, with evidence.

Worked example: a 300-person recruitment firm

A 300-person recruitment firm in the EU uses three AI tools: a spell-checker, a chatbot answering candidate questions on its website, and a tool that ranks applicants for clients. The firm’s compliance lead inventories them and classifies each.

1. The spell-checker is minimal risk. Normal software approval applies.
2. The chatbot has a transparency duty: candidates should be told they are talking to AI.
3. The applicant-ranking tool influences access to work, an area the Act treats as high risk. It needs the strongest response: documented risk assessment, data quality checks, human review of rankings, logs and records that can be shown to a regulator.

The compliance lead then writes the response into the policy (classification rules, mandatory human review for ranking), trains recruiters on reviewing rankings and not simply accepting them, and uses the NIST functions to structure the assessment. The firm also checks whether it is a provider or a deployer of each tool, because duties differ.

Easy to confuse

• Framework versus standard versus law. Voluntary guidance, certifiable requirements, binding obligation.
• Training completed versus competence shown. Completion records show awareness only.

Key points

• An AI policy covers scope, acceptable use, classification and approval, data, third parties, oversight and incidents.
• An inventory of AI in use comes before a detailed policy.
• Training is tailored to audiences: staff, owners, builders, reviewers and the board.
• Laws bind, standards are adopted and may be certified, frameworks guide.
• Risk tiers (EU AI Act) let obligations scale with use-case risk; verify current legal text.

Check yourself

This lesson completes the policy and regulation part of Domain 1, AI Risk Governance and Framework Integration (37% of the exam), covering subtopics 1D and 1E. The recap in AAIR governance and frameworks condenses it, and the responsible AI principles page supports the next lesson.