Resources
Twelve questions your AI policy has to answer
Before an insurer, an auditor, or a client asks to see it.
July 2026
An AI use policy is read by one person at a time: an insurer at renewal, an auditor against a framework, a client through procurement, a flag or port state inspector reading the SMS. Test any draft against the twelve questions that reader brings.
- Who owns it?
- Which tools does it cover?
- What information stays out of external tools?
- Where does a person check the machine's output before it leaves?
- Who may use what, for which tasks?
- What happens when an output is wrong?
- Which existing obligations does it connect to?
- Does it describe the way the team works in practice?
- What records does it keep?
- How does training connect to it?
- Who keeps it current?
- Would it satisfy the specific person asking?