Key takeaways
- A single-page “AI policy” is not enough; responsible AI use needs a connected system of policies, procedures and registers.
- An AI Management System (AIMS), ideally aligned to the international standard ISO/IEC 42001, provides that structure.
- Procedures turn policy into practice: a clear intake, risk-triage and approval pathway for every AI use case.
- Registers are the most overlooked element: an AI inventory, risk register and incident register make AI use visible and accountable.
- Done proportionately, this protects the people an organisation serves, builds trust, and prepares for emerging regulation, without becoming bureaucratic.
Beyond the One-Page Policy
As AI tools spread through organisations, most leaders recognise the need for an AI policy. Many start by producing a single page of principles outlining how AI should be used responsibly. It is a good place to begin, but on its own it rarely changes day-to-day behaviour. Staff are already using AI tools, often without anyone knowing which ones; risks accumulate quietly; and when something goes wrong, there is no agreed way to respond.
Consider what that single page typically leaves unanswered. Which tools are approved, and which are off-limits? Who decides whether a new use is acceptable? What happens to client information typed into a public chatbot? If an AI-generated document contains an error that reaches a customer, who is accountable, and what changes afterwards? While a policy establishes principles, it doesn’t always answer these practical questions, which is why organisations often fall back on ad hoc decisions.
The gap is between intent and operation. A policy states what an organisation believes. What it needs alongside that is a way to put those beliefs into daily practice and maintain a clear picture of what AI is actually being used, where, and with what level of risk. Through our work helping organisations establish responsible AI, including those operating in sectors that handle sensitive personal and client information, we’ve found that the biggest difference comes from treating AI governance as a connected system rather than a single document.
That system has three parts: policies (what we will and won’t do), procedures (how decisions get made), and registers (what we can see and account for). This article explores each, drawing on a practical, standards-aligned approach that scales sensibly for small and mid-sized organisations and non-profits.
Building an AI Management System
One practical way to bring all of this together is through an AI Management System (AIMS). If your organisation has worked with frameworks such as ISO 9001 for quality or ISO/IEC 27001 for information security, the approach will feel familiar: set objectives, assign responsibilities, manage risk and review performance over time. The equivalent international standard for AI is ISO/IEC 42001:2023, which provides a recognised framework for establishing and continually improving AI governance.
The good news is that you don’t need to pursue certification to benefit from the standard. For many small and mid-sized organisations, a practical AIMS can be implemented through a compact suite of governance documents. In our experience, four core documents provide a solid foundation:
| Document | What it covers |
| AI Policy & Governance Charter | The organisation’s values and ethical principles; permitted, restricted and prohibited uses; the governance structure and who is accountable for what; measurable objectives and the review cycle. |
| AI Risk, Impact & Compliance Standard | How AI risks are assessed based on potential harm to people; risk categories; likelihood and consequence assessments; identifying and managing high-impact uses; transparency; and compliance obligations. |
| AI Lifecycle, Data & Human Oversight Standard | The lifecycle every AI use case follows, including approval gates; data quality requirements; testing for accuracy, bias and safety; and the appropriate level of human oversight. |
| AI Operations & Assurance Playbook | Training and competency requirements; incident management; corrective actions; assurance metrics; internal audit; vendor assurance; and continual improvement. |
ISO/IEC 42001 provides an excellent foundation, but it shouldn’t be the only reference point.
In Australia, organisations should also consider the Voluntary AI Safety Standard and its ten guardrails, along with the Privacy Act, the Australian Privacy Principles, and any industry-specific obligations that apply to them. International frameworks such as the EU AI Act are also useful reference points, even where they don’t apply directly.
The goal isn’t to adopt every framework or create unnecessary complexity. It’s to build AI governance on recognised, practical guidance that fits your organisation. For most SMEs and non-profits, the Voluntary AI Safety Standard is an excellent place to start, translating broad principles into practical expectations such as maintaining records, testing systems before deployment, and being transparent about where AI is being used.
Procedures: Turning Policy into Practice
Policies describe intent; procedures make decisions repeatable. One of the most valuable procedures is a clear approval pathway for AI use cases: a defined process that every proposed use of AI follows before it goes live.
A practical pathway looks like this:
- Intake and risk triage. Anyone wanting to use or build an AI capability submits a short request. A quick triage classifies it according to its potential impact.
- Low impact uses. Uses that don’t affect a person’s rights, safety, finances or care can be approved by the relevant system owner under a standard set of guardrails. This allows everyday low-risk adoption to move quickly without unnecessary overhead.
- High impact uses. Any use that could materially affect people requires a more detailed impact assessment (including, where appropriate, a fairness or human-rights lens) and approval from the appropriate governance body before deployment.
- Monitoring. Once deployed, the AI capability is monitored for accuracy, performance drift and any emerging issues.
- Review on change. Material changes, or scheduled review points, trigger a reassessment to ensure the use case continues to meet governance requirements.
This approach keeps governance proportionate. Low-risk experimentation doesn’t become bogged down in unnecessary approvals, while higher-impact uses receive the additional scrutiny they deserve.
For example, using Microsoft Copilot to improve the grammar of internal emails is a low-impact use case that can usually be approved quickly. Using AI to help rank applicants for a hardship grant is very different. Because it could influence decisions that affect people’s access to support, it warrants a formal impact assessment and a second set of eyes before it goes live.
Supporting this process are a handful of practical, reusable templates, including an intake and triage form, an impact assessment template, a model or system card describing what an AI capability does and its limitations, and an incident reporting form.
Human oversight is just as important. Good practice distinguishes between a human being in the loop (approving each action), on the loop (supervising and being able to intervene), or in command (setting the rules within which a system operates). Deciding which level of oversight is appropriate for each case, and documenting that decision, helps ensure AI supports human decision-making rather than quietly replacing it. As a general rule, the greater the potential impact on people, the closer the human oversight should be.
Registers: Maintaining Visibility
Policies establish expectations, and procedures guide decision-making. Registers provide visibility into what’s actually happening across the organisation.
Without that visibility, effective governance becomes difficult. AI tools can be adopted in minutes, often by individual teams or departments, meaning “shadow AI” is becoming increasingly common.
If an organisation doesn’t know what AI is being used, it’s difficult to understand or manage the risks that come with it.
Three registers form the backbone:
- The AI System Inventory. A living catalogue of every AI capability the organisation uses, builds, procures or configures, whether it’s a major embedded feature or a departmental chatbot. It records what each capability does, who owns it, what data it touches, and its risk classification. This inventory becomes the foundation for everything else.
- The AI Risk Register. A record of identified AI risks, their assessed likelihood and consequence, the controls in place to manage them, and who is accountable. It turns AI risk into something that can be monitored, reviewed and acted upon.
- The AI Incident (and Corrective Action) Register. A record of AI-related incidents, such as inaccurate outputs, privacy near-misses or inappropriate use, along with the actions taken and any improvements made afterwards. It helps ensure the organisation learns from issues rather than repeating them.
None of these registers requires specialised software to get started. For many organisations, a well-structured spreadsheet or SharePoint list is more than enough, provided someone owns it and keeps it up to date. The discipline of maintaining the registers is far more important than the tool itself.
Registers can sound bureaucratic, but in practice they’re one of the simplest ways to gain visibility over AI use across the organisation. They give leadership a clear picture of the organisation’s AI footprint, make board reporting and audits much easier, and provide the kind of evidence that regulators, funders and insurers increasingly expect to see.
Who Owns It: Governance in Action
A system needs an owner. For most organisations, that role is best fulfilled by a small AI Governance Committee that oversees the AIMS on behalf of the board or executive. Its role is to make decisions, not write reports: approving high-impact use cases, maintaining the registers, pausing AI that isn’t behaving as expected, and escalating material risks when needed.
For a smaller organisation, this committee can be lean: a handful of people covering executive sponsorship, privacy, the relevant operational area, IT, and risk or quality. In a non-profit, that might be the operations manager, the person responsible for privacy, and an IT representative meeting together; the roles matter more than the headcount. What matters most is that the committee meets regularly (quarterly is sufficient for many organisations, with the ability to convene quickly if needed), has clear authority, and has a named chair responsible for driving decisions. Governance works best when ownership is clear. Otherwise, responsibility can quickly become everyone’s job, and no one’s.
What It Looks Like in Practice
Consider a community services organisation that wants to use AI to draft case notes from session recordings. Under a one-page policy, a well-meaning staff member might simply get started, with client information flowing through whatever tool happened to be closest at hand.
With a governance system in place, the process looks different, but no more complicated than it needs to be. The request enters through intake and is triaged as high impact because it involves sensitive personal information and contributes to records about a person’s care. An impact assessment considers accuracy, privacy and the possibility of transcription errors. The team decides a human must remain in the loop, reviewing and approving every note before it is saved. The AI capability is recorded in the system inventory together with its owner and data flows, while the identified risk (transcription errors) is captured in the risk register along with the agreed treatment. Three months later, when a name is incorrectly auto-corrected, the near miss is logged in the incident register, and the review process is updated.
The technology hasn’t changed. The difference is the governance surrounding it. Staff can use AI with confidence, and the organisation has a clear, auditable record of how risks have been managed along the way.
Keeping It Proportionate
At this point, many SMEs, corporates, and non-profits are probably thinking, this sounds like a lot. It doesn’t have to be.
The same structure scales surprisingly well. A short governance charter, one risk standard, a simple lifecycle and oversight document, a lightweight assurance playbook, one approval pathway supported by a handful of templates, and three registers maintained in a shared workbook or SharePoint list are enough to establish a credible first version. For most organisations, that can be achieved in a matter of weeks rather than months. The aim is to keep governance proportionate, applying greater rigour where the risks are higher, while keeping everyday AI use straightforward.
The benefits extend well beyond compliance. You reduce the risk of AI-related harm, build trust with clients, members, funders and staff, and put your organisation in a much stronger position as AI regulation continues to evolve. Just as importantly, you replace the uncertainty of “What AI are we actually using?” with a clear and defensible answer.
A Sensible Starting Point
Most organisations don’t need to build the entire system at once.
A practical first step is to establish an AI System Inventory, simply identifying what AI is already being used across the organization, alongside a short policy and a basic triage process. Even that small step provides visibility that didn’t exist before and often uncovers a few surprises worth addressing. From there, additional standards, procedures and registers can be introduced over time as the organisation’s AI maturity grows.
At 365 Architechs, we help organisations build practical, right-sized AI Management Systems that align with recognised standards without becoming unnecessarily complex. The goal isn’t to create more paperwork, it’s to give organisations the confidence to adopt AI responsibly, with governance that supports innovation rather than slowing it down.
Want to replace a one-page policy with a working AI Management System? Contact 365 Architechs to get started.
