A policy needs a decision owner
Consider an AI assistant that summarizes incident reports for a crisis team. Its output can influence how the team understands the situation, which information it considers urgent, and what it investigates next. The organization needs to decide who checks the summary and what source material remains available to the team.
This illustrative case connects security with leadership. Information protection concerns who can access the reports. Leadership concerns who is authorized to assess the situation and decide what happens next. Both depend on how the workflow is organized.
Translate the requirement into a procedure
A statement such as “AI output must be reviewed” leaves the process undefined. It needs to identify the reviewer, the information used for the assessment, and the action that requires prior review. It must also address disagreement and the reviewer’s absence.
I approach these questions by tracing the requirement through the work. Identify the responsible role, the information that role needs, the point at which a decision is made, and the record that shows what happened. The procedure should also cover the exception that prevents normal processing.
An information security management system provides a structure for assessing risks and assigning controls. It still requires people to decide how those controls apply to a particular workflow. Purchasing an AI service does not resolve that organizational task.
Test the point where a person must intervene
For the incident-summary example, an exercise could introduce a report containing conflicting information. The team can then examine whether the summary preserves the uncertainty, whether reviewers can inspect the source, and whether they know when to stop relying on the output.
Use the exercise to improve the review procedure. Extend testing to the other actions that depend on the output, starting with those that carry the greatest consequences.
Give management a usable decision
A review should leave management with a specific choice: continue the workflow within its current limits, change the controls, narrow the agent’s authority, or stop its use until an identified issue is resolved.
Record the reason, assign responsibility for the change, and define when the decision will be reviewed. That connects the security finding with an action someone can carry out.