AI Governance and Security Policy

Executive summary

Our approach is deliberately practical. It focuses on understanding what AI exists within the organisation, what it is used for, what risks it creates, what controls are required, and how decisions remain subject to meaningful oversight. This supports lawful, secure and transparent use of AI and helps us evidence good governance to clients, partners and regulators.[4]

Policy statement

Document control

• Policy title: Artificial Intelligence Governance and Security Policy
• Organisation: SafetyDocs Ltd
• Version: 1.0
• Executive owner: Managing Director / CEO
• Policy owner: Risk & Compliance Lead or equivalent
• Review cycle: At least annually, and on material change

AI policy statement

SafetyDocs Ltd will design, procure, deploy and use AI systems lawfully, securely, ethically and with appropriate human oversight, while maintaining documented governance, risk management, assurance and continuous improvement controls across the AI lifecycle.

Scope

This policy applies to:

• all staff, contractors and third parties acting on behalf of SafetyDocs Ltd
• all AI systems, models, tools, embedded AI features and experimental uses
• all uses involving business data, client data, personal data, safety-related content or material business decisions

Policy principles

• AI will only be used where it is proportionate, justified and the right tool for the task.
• AI use must comply with applicable law, including privacy, intellectual property, equality, cyber security and sector-specific obligations.
• AI systems must be risk assessed before use and periodically reassessed as they change.
• Human oversight must be meaningful and proportionate to the risk and impact of the use case.
• AI tools must be secure by design and monitored for misuse, drift, error and cyber risk.
• AI use must be transparent, documented and communicated appropriately to relevant users and stakeholders.
• Suppliers and third parties must be assessed against equivalent governance expectations.
• Staff must receive role-appropriate guidance and training on approved AI use.
• The organisation will maintain and continually improve its AI governance arrangements.

Prohibited and restricted uses

SafetyDocs Ltd will not use AI in ways that are unlawful, deceptive, discriminatory, unsafe or inconsistent with this policy. Where the EU AI Act applies, prohibited practices must not be deployed. Where privacy, rights or significant effects on individuals may arise, the use case must be escalated for formal assessment and approval.[3] [6]

Transparency and communications

We will document material AI use and, where appropriate, disclose when users are interacting with AI or receiving AI-assisted or AI-generated outputs. Customer-facing AI use must have a clear route for review, escalation and correction where required.[2] [3]

Security and data handling

AI tools must be used securely, with rules governing what data may be entered, how outputs are validated, how access is controlled, and how incidents are identified and managed. AI suppliers must be assessed for security posture and supply chain risk.[5] [4]

Governance model

SafetyDocs Ltd operates an AI governance structure with clear ownership, review and escalation. At minimum, this includes: an executive owner, a policy owner, a risk/compliance lead, a security lead, a procurement lead, and a named owner for each relevant AI use case.

For higher-risk or customer-facing systems, formal review and approval is required, with documented decisions, restrictions and escalation paths.

Roles and responsibilities

Governance in practice

Our AI governance approach is structured around five practical stages. These stages are not presented here as a public toolkit, but as the operating model we use to maintain control, accountability and improvement over time.

Discover and inventory

We maintain visibility over AI tools, models, embedded AI features and experimental uses across the organisation. This includes understanding what exists, who owns it, what it is used for and what data it touches.

Classify and assess

We assess AI uses for legal, ethical, security, operational and reputational risk. Where relevant, we consider whether a use case may fall into prohibited, high-risk, transparency-sensitive or minimal-risk categories under the EU AI Act, and whether UK data protection obligations apply.[3] [6]

Control and assure

We apply controls for data handling, human oversight, testing, approvals, supplier management and incident response. Higher-risk uses require more formal assurance before go-live and periodic review afterwards.[5]

Train and enable

We provide role-appropriate guidance so staff understand what AI can and cannot be used for, how outputs should be checked, and how concerns should be escalated. Governance only works when supported by practical awareness and responsible use.[2]

Monitor and improve

We review AI tools and use cases for drift, quality issues, security concerns, incidents and changing legal obligations. Findings from reviews, errors, complaints and changes in suppliers or models are used to update controls and improve governance over time.

Governance records maintained

How this is implemented

SafetyDocs Ltd applies this policy through documented governance, designated ownership, risk-based approvals, supplier checks, staff guidance and periodic review. We review AI use at least annually and sooner where there is material change, such as:

• a new AI tool, model or embedded feature being introduced
• a change in supplier, processing arrangement or hosting location
• a change in the type of data processed
• a change in whether the use is customer-facing or decision-supporting
• an incident, complaint, near miss or material output quality issue
• a legal or regulatory development affecting AI governance or privacy obligations