Compliance automation tool

Security policies are approved by management, published and acknowledged by staff, and reviewed at least yearly.

An approved AI policy says how AI is developed, bought and used, and who decides.

Named owners for security, privacy and AI risk, with authority and a reporting line to leadership.

Risks are assessed with a defined method at least yearly and on major change, and each has an owner and a treatment.

The effects of each AI system on people, groups and society are assessed before use and when it changes.

Hardware, software and cloud resources are inventoried with an owner, and the list stays current.

Every AI system and agent in use is listed with its owner, purpose, data and permissions.

Access is requested, approved and granted by role; admin rights are limited and separately approved.

Everyone has their own account and MFA protects every system that holds sensitive data.

Access is revoked promptly (typically within a day) when someone leaves or changes role.

Owners review who has access to key systems at least quarterly and remove what isn't needed.

Sensitive data is encrypted where stored and when it moves over networks.

Company devices have malware protection, disk encryption, screen lock and current updates.

Systems and dependencies are scanned, and findings are fixed within set timeframes by severity.

Security-relevant activity is logged centrally, retained and reviewed, with alerts on anomalies.

A tested plan says how incidents are reported, triaged, contained, communicated and learned from.

AI systems and agents log their inputs, actions and outputs, and their behaviour is monitored in production.

People can understand, intervene in and override AI outputs and agent actions where it matters.

Users and deployers are told when they deal with AI, what it is for and its limits.

Production changes are reviewed, tested and approved before release, and emergency changes are reviewed after.

Code is reviewed and security-tested before release, and environments are separated.

Critical data is backed up on a schedule and restores are tested.

A continuity and recovery plan exists, is tested at least yearly, and lessons are acted on.

Vendors (including AI model and data suppliers) are assessed before use and reviewed, with security terms in contracts.

Staff complete security training at onboarding and yearly; people who build or use AI also learn its risks.

New staff are screened as the role requires and sign confidentiality terms.

Data used to build or tune AI systems has a known source, meets quality criteria and is prepared in a documented way.

AI systems are validated before release and after changes, including robustness, security and prompt-injection testing.

The programme is audited internally on a schedule and leadership reviews results and decides on improvements.