AI Governance and Program Management · Topic 3 of 6
AI Strategy, Charter, Policies and Procedures
AI governance charter, roles and RACI, an AI strategy aligned to business goals, AI security policy, standards, procedures and acceptable use rules.
- 5 min
- AI security strategy is derived from business objectives and risk appetite.
- A charter defines the governance body's authority, membership and decision rights.
- Business owners are accountable for AI use cases; security advises.
What it is
An organization needs a clear answer to three questions before AI spreads: who decides, what is allowed, and how it is done. The governance charter and roles answer the first, the AI strategy and policy answer the second, and standards, procedures and guidelines answer the third.
For AAISM the starting point is always the business. AI security strategy exists to let the organization gain value from AI at an acceptable level of risk, not to block AI or to chase technology for its own sake.
How it works
The governance charter and roles
AI governance is usually led by a cross-functional AI governance committee or council with a written charter. The charter states its purpose, scope, authority, membership, decision rights, escalation path and reporting line to senior management or the board.
| Role | Responsibility |
|---|---|
| Board or risk committee | Oversees AI strategy and risk; approves appetite |
| Executive sponsor | Accountable for the AI program overall |
| AI governance committee | Approves high-risk use cases, policy and exceptions; resolves conflicts |
| Business or use case owner | Accountable for an AI system, its outcomes and its risk |
| Model owner or developer | Builds, tunes, documents and maintains the model |
| Information security manager | Advises on AI security risk, sets security requirements, monitors and responds |
| Privacy, legal and compliance | Interpret obligations, review impact assessments |
| Internal audit | Gives independent assurance over AI governance and controls |
A RACI chart makes these roles explicit for each activity, such as approving a new use case, validating a model or accepting residual risk. Without clear ownership, AI risk ends up owned by nobody.
The AI strategy
The AI security strategy describes the desired state of AI security and the roadmap to reach it. It is built from the business AI strategy, the risk appetite, regulatory obligations and a gap analysis of current capabilities. It names priorities, resources, milestones and the metrics that show progress.
The AI policy and what it covers
The AI policy is a short, high-level statement of management intent, approved by senior management. Detail goes into standards and procedures so the policy does not need constant changes.
| Policy area | Typical content |
|---|---|
| Scope and principles | Which AI is covered, including third-party and embedded AI; responsible AI principles |
| Use case approval | Every new AI use is registered and risk-tiered before use |
| Prohibited uses | Uses the organization will not pursue, including those banned by law |
| Data | What data may be used for training, prompts and retrieval, by classification |
| Human oversight | When a person must review or approve AI output |
| Third-party AI | Requirements before buying or enabling vendor AI features |
| Transparency | When users and customers must be told AI is in use |
| Exceptions | How exceptions are requested, approved, time-limited and reviewed |
AI-specific requirements can sit in a dedicated AI policy or be woven into existing policies such as acceptable use, data classification and third-party risk. Either way, they must be consistent with the rest of the policy framework.
Standards, procedures and guidelines
| Document | Nature | AI example |
|---|---|---|
| Policy | Mandatory intent | "AI systems are risk-assessed before use" |
| Standard | Mandatory, specific | Minimum logging, testing and access requirements per risk tier |
| Procedure | Mandatory steps | How to register and assess a new AI use case |
| Guideline | Recommended practice | How to write prompts that avoid sharing sensitive data |
Acceptable use guidelines
Most employees meet AI as users of generative AI tools. Acceptable use guidelines tell them which tools are approved, what data must never be entered into public tools, that AI output must be checked before it is relied on or published, how to label AI-generated content, and how to report problems.
Clear, practical rules reduce shadow AI, where staff use unapproved tools because no sanctioned option exists. Offering an approved tool with suitable data protections often works better than a ban.
A worked example
Staff in marketing and legal are pasting customer documents into free public chatbots. There is no AI policy.
The security manager does not start by blocking every AI site. The FIRST step is to bring the issue to the governance committee and obtain management direction. The committee approves a short AI policy and acceptable use guideline, an enterprise tool with contractual data protections is offered, public tools are restricted for confidential data, and awareness messages explain why.
How the exam asks about this
- "What should be established FIRST to govern AI across the organization?" A charter with clear roles, responsibilities and decision rights, aligned to business objectives.
- "Who should approve the AI security policy?" Senior management.
- "Employees are using unapproved generative AI tools. What is the BEST response?" Issue clear acceptable use guidance and provide an approved alternative, supported by awareness, rather than relying on a blanket ban.
What to remember for the exam
- AI security strategy is derived from business objectives and risk appetite.
- A charter defines the governance body's authority, membership and decision rights.
- Business owners are accountable for AI use cases; security advises.
- Policy states intent; standards and procedures hold the detail.
- Acceptable use guidelines and approved tools reduce shadow AI.
A policy that nobody knows about, or that has no exception process, is routinely ignored. Communicate it, train on it and give people a legitimate way to request exceptions.
Common mistakes
Starting with technology. Buying an AI security tool before the strategy, roles and policy exist leaves no basis for deciding what the tool should enforce.
Putting technical detail in the policy. Model-specific settings change often; they belong in standards and procedures, so the policy stays stable and approved.
Forgetting embedded AI. Policies that cover only in-house models miss AI features switched on inside software the organization already uses.
Check yourself
What does an AI governance charter define?
The governance body's purpose, scope, authority, membership, decision rights, escalation path and reporting line.
Where should detailed AI security requirements such as logging levels be written?
In standards and procedures, not in the high-level policy.
Why provide an approved AI tool instead of only banning public tools?
People use unapproved tools when no sanctioned option exists, so an approved tool with protections reduces shadow AI more effectively.
Topic 3 of 6 in AI Governance and Program Management
Test yourself on AI Governance and Program Management
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.