A useful starting policy explains which tools are approved, what information may be used, who checks the output, and which decisions remain with people. It should be written for the people doing the work, with examples they recognize.
Include a way to report mistakes and ask questions. For instance, distinguish drafting a public announcement from processing a private customer record. Review the policy as your uses change, and seek appropriate professional advice for your obligations. A short, understandable policy that people follow is more useful than a long document nobody can apply.
Further reading
- AI Risk Management Framework
National Institute of Standards and Technology · Publication date not established
Context and limits
Guidance on assessing AI risks, protecting information and keeping people accountable for decisions.
The framework was released in January 2023 and its generative-AI profile in July 2024. These are the resources' release dates, not the webpage's publication date. Citing this guidance does not mean TideProof has been certified by NIST.
Sources explain the background. Examples and suggested next steps are TideProof's own guidance.