Clarify data paths and accountability
The work assignment is to govern permitted AI use in practical, understandable terms. Define purpose, owner and permitted operating boundary before the first test.
The domain review baseline covers scope, data classes, accounts, approvals, incidents and training. Assumptions and missing information remain visible in the result.
Embed controls in the workflow
- Define scope, permitted accounts and business data classes with accountable owners.
- Describe approvals and incident reporting using concrete work examples.
- Test the policy with staff for clarity and unresolved cases.
- Record training, contact people and a date for reviewing the rules.
Review approval against evidence
Using representative tasks, staff can explain which account and data are permitted, when approval is needed and where to report an incident. Unresolved interpretation questions are documented.
Avoid: publishing a template without operational adaptation. An unchanged published template provides insufficient guidance if it reflects neither actual data classes nor operational contacts and approval paths.
Decision matrix
| Decision point | Proceed when | Stop when |
|---|---|---|
| Data and accountability | Documented: scope, data classes, accounts, approvals, incidents and training. | Scope, data or accountability remains unresolved. |
| Control evidence | Using representative tasks, staff can explain which account and data are permitted, when approval is needed and where to report an incident. Unresolved interpretation questions are documented. | There is only an unevaluated demo without acceptance evidence. |
| Approval boundary | Owner, approval, fallback and next review date are defined. | Avoid: publishing a template without operational adaptation. An unchanged published template provides insufficient guidance if it reflects neither actual data classes nor operational contacts and approval paths. |
Keep it verifiable
Primary sources
- NIST: AI Risk Management Framework coreSource checked:
- EUR-Lex: Regulation (EU) 2016/679Source checked:
