How to stand up AI governance policies from templates

This guide covers the three parts of the job. It sets out what policies a program actually needs and how to build them from templates instead of drafting by hand. It then covers the part most people skip, which is how to keep them current once they exist.

Aicura provides governance support, not legal advice. It generates and maintains policies for you to review. The decision to adopt them sits with you and the accountable owner in your organisation.

What an AI governance program’s policy layer needs

A policy pack does not need to be long to be useful. It needs to cover the decisions your organisation keeps having to make about AI, so that people are not making them case by case. In practice the core set is small.

• An AI use policy. The umbrella document. Who can use AI, for what, what is acceptable, what is prohibited and where a use has to be reviewed before it goes ahead.
• Roles and accountability. Who owns AI governance, who signs off on a new system and who is accountable when a system is in use.
• Procurement and third-party AI. How AI is brought in through vendors and embedded features, and what has to be checked before a tool is adopted.
• Data handling in AI systems. What data can go into which systems, and the limits on how it is used.
• Human oversight and review. Where a person stays in the loop, and how decisions made with AI are reviewed.
• Transparency and disclosure. When and how the organisation tells people that AI is being used.

These map to the principles the frameworks are built on. AI6 and the NSW AIAF both turn on accountability, transparency, fairness, privacy and security, human oversight and safety, so a policy set that covers the ground above is a policy set grounded in the frameworks rather than in one author’s judgment.

Build each policy from a template, not a blank page

A policy written from scratch is slow to produce and hard to keep consistent with the rest of the program. A pack commissioned from a consultant arrives complete and then starts to age from the day it lands, because it is not connected to how your AI use actually changes. Starting from templates avoids both problems.

The workflow inside Aicura is straightforward.

1. Register the AI systems you have. Aicura is your AI Register. It holds the AI systems in use as the record and versions them as they change, so your policies are written against a real footprint rather than a guess at one.
2. Open the policy templates. Aicura ships Policy Templates grounded in AI6 and the NSW AIAF. Each template already carries the structure and the framework language, so you are editing a grounded draft, not composing one.
3. Generate each policy from its template. Aicura generates the policy against your registered systems and the risk assessments and controls the program has already produced, so the document reflects your organisation rather than a generic sample.
4. Review and adopt. The generated policy is a draft for review. You and the accountable owner read it, adjust it and decide whether to adopt it. Aicura does not certify a policy or sign it off. That decision stays with your people.

Done this way, standing up the policy layer is a matter of review and sign-off, not months of drafting. You are not paying for an army of analysts and you are not paying for a one-off pack.

Keep the policies current as your AI use changes

This is the part that gets skipped, and it is the part that decides whether the policy layer is worth anything a year in. AI use inside an organisation moves. New tools arrive, existing tools gain features and the frameworks themselves are revised. A policy that was accurate when it was written drifts out of step with the footprint it was meant to govern, and a one-off pack has no way of noticing.

Because Aicura generates the policies as part of the program, they stay connected to the register, the risk assessments and the derived controls. When your registered footprint changes, or when a policy needs to reflect a new control, Aicura generates the update for you to review. It maintains the policy set alongside the program rather than leaving it as a document that someone has to remember to revisit. You keep deciding what to adopt. Aicura keeps the drafts current so that deciding is all that is left to do.

Set a review rhythm regardless. Even with the drafting maintained for you, an accountable owner should look over the policy set on a set cadence and after any material change to your AI use, and record that the review happened.

Where this sits in the program

Policies are one layer of the Essentials doing layer. They read from the same register and risk picture as your controls and your risk register, which is why they can be generated and kept current rather than written and forgotten. If you are building the program in order, the risk register and the controls come first, and the policies are written against them.

• Read the scenario this guide supports: Establish and improve governance policies
• Pair it with Derive controls from your risk assessments
• And with Build an AI risk register
• The frameworks the templates are grounded in: AI6 and the NSW AI Assessment Framework

You can register your first system and open the policy templates at https://app.aicura.com.au/signup.

A note on this page

This guide is written to help you do the work. It is guidance, not legal advice, and it is not a certification, an audit or a compliance verdict. For the requirements themselves, go to the primary sources, being the published AI6 framework and the NSW AI Assessment Framework, issued by the NSW Government. Where your organisation needs a formal legal or regulatory view of its obligations, get advice that is specific to your circumstances.

Aicura is a product of Aicura Pty Ltd.