AAISM lesson 2: AI strategy and policy

An AI security strategy states how the organisation will use AI safely to reach its business goals, and policies turn that intent into rules people can follow. Subtopic 1B covers both, and the supporting tasks add a charter with roles and responsibilities. Two facts anchor the topic: the strategy is derived from business objectives rather than from technology, and the documents form a hierarchy in which each level is more specific and easier to change than the one above.

Strategy follows the business

A strategy that begins with “secure the models” has skipped a step. The business decides where AI creates value, for example faster claims handling or better demand forecasts, and security strategy describes how to enable those uses within acceptable risk. It typically covers the ambition (which uses are encouraged, tolerated or prohibited), the risk appetite for AI, the principles that guide decisions, the resources needed, and how success will be measured. Because appetite differs by use, a strategy often sorts uses into tiers: low-impact internal drafting help sits at one end, decisions that affect customers’ rights or money at the other, and the depth of control rises with the tier. This mirrors how the EU AI Act and the NIST AI RMF both scale effort to risk. See security frameworks for the general pattern.

The document hierarchy

Security managers already know the hierarchy, and the useful skill is applying it to AI.

The rule of thumb: policies say what and why, standards say how well, procedures say who does what and in which order. A policy that mentions a vendor’s product name is written at the wrong level and will date quickly.

An acceptable use policy sits at the centre of the AI set. It defines which tools staff may use, what data may be entered, what must never be pasted into a public service, whether outputs must be reviewed, and how to disclose AI-generated content. Alongside it, an AI security policy typically deals with model and data protection, access, third-party models, testing, human oversight and incident reporting. Exact titles vary, so know the topics rather than the names.

Charter, roles and responsibilities

Policies without owners are decoration. A governance charter establishes the body that decides on AI (often an AI governance committee or an extension of an existing risk committee), its membership, its authority and its reporting line. Typical roles are:

• Executive sponsor or board: sets appetite and holds ultimate accountability.
• Business owner of the AI use: accountable for outcomes and for accepting residual risk.
• Data owner: decides what data may be used.
• Security manager: defines security requirements, assesses, monitors and reports.
• Legal, privacy and compliance: interpret obligations.
• Technical teams: build and operate within the requirements.

A sound study approach is to prefer answers in which accountability sits with a business owner and the security function advises and verifies. The security manager rarely owns the business risk of a use case.

A worked example

A 400-person insurer discovers that underwriters use a public chatbot to summarise broker emails. The sequence matters. First an inventory shows how widespread the use is, as lesson 3 explains. Next, leadership states in the strategy that low-risk assistance is welcome but that customer data may only go to approved services. A short acceptable use policy follows, backed by a standard defining what “approved service” means (contractual terms, no training on inputs, logging), and a procedure for requesting approval. Finally a guideline offers prompt advice. Starting with a ban or a long policy before understanding use usually sends the behaviour out of sight.

Easy to confuse

• Standard versus guideline. A standard is mandatory; a guideline is advice.
• Policy versus procedure. A policy rarely changes and names no tools; a procedure lists steps and does.
• Governance versus management. Governance sets direction and oversight; management runs the programme day to day.

Key points

• Strategy derives from business objectives and stated risk appetite, not from technology preference.
• Tiering AI uses lets control depth scale with impact.
• The hierarchy runs policy, standard, guideline, procedure, from stable to changeable.
• Acceptable use is a core AI document and covers tools, data and review of outputs.
• A charter creates the decision body and assigns accountability to business owners.

Check yourself

This lesson covers subtopic 1B of Domain 1 (31%); revise the whole domain with the governance and programme management recap.