Governance & Compliance · Data artifact
AI Governance Policy
Data artifactGovernance & ComplianceSafety, Security & Governancearc:AIGovernancePolicy
A leadership-approved policy artifact stating acceptable AI uses, prohibited applications, governance decision procedures, and criteria for when human oversight is required.
Responsibility. Translates organizational values into binding rules on permissible AI use.
Also known as: AI policy, Acceptable use policy, Responsible AI policy
Relationships
configures structural
- Oversight Gate abstract Ch9.8
constrains control
- Agent Controller abstract Ch9.8
is audited by assurance
Design guidance
- MUST specify prohibited applications where risk exceeds organizational tolerance.
- MUST specify criteria for when human oversight is required.
- SHOULD be visibly supported and resourced by top management, not only documented.
Classification
- Patterns
- NIST AI RMF Govern functionPrepare stage of staged NIST AI RMF implementation
- Quality attributes
- Transparency and accountability (NIST AI RMF: accountable and transparent)Reliability (ISO/IEC 25010 | NIST AI RMF: valid and reliable)
- Risks mitigated
- Policies existing only on paperDeployment of AI in prohibited applications
- Frameworks & regulations
- NIST AI RMF: GOVERNISO/IEC 42001 §5 LeadershipISO/IEC 42001 Annex A: governance controls
Sources
- Ch9.8: T. Nguyen, "Standards and Frameworks for AI Governance," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.8. ISBN: 9798244538229.