Visibility
- Real AI tools and use cases have been inventoried.
- Each use case has a purpose, owner and data category.
- Personal accounts and informal automations are part of the review.
Rules and decisions
- Employees can distinguish permitted, conditional and non-permitted uses.
- A new-tool request has an owner and decision deadline.
- Data and human-review rules use examples from actual work.
Operation
- The policy has an owner and review date.
- Training, acknowledgement and working materials are consistent.
- People can report incidents and exceptions through a known route.
Next step
Turn every unconfirmed item into a discovery question or owned action; do not label it a compliance failure automatically.
General working material. It is not certification, legal advice or a substitute for legal, DPO, HR or security review appropriate to the organisation.