What it means
- One written policy that says how the company builds, buys and uses AI, signed off by the board (or the CEO and leadership team where there is no board-level process).
- It sets the rules of the road: who owns AI risk, what risk appetite the company accepts, which uses are banned, which need extra approval, and how customers are protected.
- It covers staff use of outside tools too (ChatGPT, Copilot, Gemini, AI features inside SaaS products), not only in-house models.
- It is a living document: version-controlled, reviewed at least yearly and whenever a major law or incident changes the picture.
Why it matters
- Regulators and auditors start here. RBI FREE-AI expects a board-approved AI policy as the anchor for everything else.
- Without it, every team makes its own AI rules, and nobody can show who approved what.
- Enterprise customers increasingly ask "do you have an AI policy?" in security questionnaires; a signed policy closes that question fast.
Checklist
- Draft an AI policy covering: scope, definitions of "AI system", principles, roles, risk appetite, risk tiering, prohibited uses, approval process, data rules, customer protection, disclosures, model lifecycle, incident handling and liability.
- Add a section on staff use of third-party and GenAI tools: approved tool list, what data may never be pasted in, and how to request a new tool.
- Cross-reference existing policies (information security, privacy, outsourcing, model risk) so they do not contradict each other.
- Present to the board or Risk Management Committee and record approval in minutes.
- Publish internally (intranet, HR portal) and require staff acknowledgement.
- Set a review cycle (at least annual) and named owner; log each review even if nothing changes.
- Track exceptions: who asked, why, who approved, expiry date.
Evidence examples
- Board or RMC minutes approving "AI Policy v1.2" with date and resolution number.
- The policy document itself with version history, owner and next review date.
- Staff acknowledgement report from the HRMS or LMS (for example 96% of employees acknowledged by a set date).
- Approved AI tools list and the exception register.
- Annual review record showing the policy was checked against new rules (for example the 2026 IT Rules amendment).
Common pitfalls
- Copying a generic template that does not match how the company actually uses AI.
- Forgetting shadow AI: staff using free GenAI tools with customer data while the policy only covers in-house models.
- Approval by a single manager instead of the board or top management.
- No review date, so the policy goes stale within a year.
- Policy says "high-risk uses need approval" but never defines high risk (see SC-AI-004 AI risk classification and use-case tiering).
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- VoluntaryNIST AI RMF and GenAI Profile
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- BindingTexas TRAIGA
- BindingKorea AI Basic Act
- SupervisoryOSFI E-23
- VoluntaryRBI FREE-AI
Also relevant to
- India AI Governance Guidelinesno numbered obligations; mapped in its practical notes (adopt voluntary principles, codes and standards)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 5.1 Leadership and commitment
- 5.2 AI policy
- A.2.2 AI policy
- A.2.3 Alignment with other organisational policies
- A.2.4 Review of the AI policy
ISO/IEC 27001
- A.5.1 Policies for information security
- A.5.4 Management responsibilities
- A.5.36 Compliance with policies, rules and standards
SOC 2
- CC1.2
- CC5.3
Key takeaways
- The board-approved AI policy is the root control; most other controls point back to it.
- Strong reuse of your existing ISO 27001 policy machinery (approval, versioning, review, acknowledgement). The AI-specific content (risk appetite for AI, prohibited uses, GenAI rules) is new.
- Cover third-party and GenAI tool use, not just models you build.