A governance system your board adopts, owns and can stand behind.

An AI policy suite and an appetite schedule that sets which uses are permitted, on what information, in which environments, and with what degree of reliance on the output.

A defined procedure and register for approving each AI use, with named approvers and gates that must be cleared for personal information, special personal information, privileged material and externally restricted information.

A method for assessing and treating AI risk that ties into the risk management the organisation already runs.

Resolution papers, a delegation matrix and attestations, so that each policy has a named owner, a review date and a formal adoption by the approving body.

A management review and review cadence that keeps the board re-informed as AI use changes.