Acceptable-use policy
Practical rules for approved tools, data, human review, escalation and prohibited uses.
WHAT THIS HELPS SOLVE
Focus the review on decisions that matter.
Rules are unclear
Employees need practical boundaries on approved tools, sensitive data, prohibited use and when human review is required.
Approvals are inconsistent
A repeatable process helps teams assess new AI tools and use cases without making every decision from scratch.
Ownership is fragmented
Governance clarifies who owns AI decisions, exceptions, supplier review and ongoing monitoring.
WHAT WE REVIEW
Scope shaped around your organisation.
Approved tool register
A maintained view of important AI tools, owners, purposes, suppliers and approval status.
AI risk assessment
A consistent way to review new AI use cases before adoption or expansion.
Data guidance
Clear expectations for confidential, personal, regulated or commercially sensitive information.
Roles & approvals
Accountability for approving tools, managing exceptions and reviewing material changes.
Review cycle
A proportionate cadence for revisiting tools, suppliers, policy and emerging business use cases.
WHAT YOU RECEIVE
Useful outputs for management and delivery teams.
✓
Governance pack
Core policy and governance material tailored to the agreed scope.
✓
Decision framework
A practical process for assessing new AI tools and use cases.
✓
Roles and ownership
Clear responsibilities for approvals, exceptions and review.
✓
Implementation guidance
Actions to move governance from documents into day-to-day working practices.
PROCESS
Simple, transparent engagement.
01
Scope
Understand the business context and agree what the engagement should cover.
02
Review
Assess the agreed controls, practices, evidence and relevant technology.
03
Prioritise
Separate material issues from lower-value improvement opportunities.
04
Act
Use the roadmap internally or ask ISTA to support the improvement work.
FAQ
Common questions
What should an AI acceptable-use policy contain?
It commonly covers approved tools, confidential information, personal data, intellectual property, human review, prohibited uses, incident reporting and accountability.
How often should AI governance be reviewed?
The frequency should reflect how quickly tools, suppliers and business use cases change. The important point is to assign ownership and a repeatable review cycle.
Is AI governance only a legal issue?
No. It spans security, data, technology, supplier, operational and management considerations. Specific legal or regulatory questions may require legal advice.
NEXT STEP
Discuss the right scope for your business.
Tell us what is driving the review and we will discuss a sensible starting point.