AI Governance Policy and Controls

Prepared for: Small Rock Trust Company (illustrative) — an independently owned Trust Company, 32 staff, Jersey.
Prepared by: Change AI Consortium

This document is one of two linked deliverables. The named opportunities, the pilot and the 30-day sprint sit in a companion document: read the sample AI Implementation Roadmap.

1. AI use policy

Small Rock Trust Company — AI Use Policy (illustrative)

1. Purpose. This policy sets out how Small Rock Trust Company uses AI tools, so that every member of staff knows what is allowed, what is not, and who to ask.

2. Scope. Covers any AI tool used in the course of work, whether provided by the firm or brought by an individual. Personal AI accounts may not be used for firm business. AI use falls into three tiers:

Tier A: staff use of AI tools, such as drafting or summarising with a general AI assistant.
Tier B: AI built into vendor platforms, such as screening, document or practice-management systems that add AI features.
Tier C: the firm's own models, such as in-house risk scoring or analytics.

For a firm of Small Rock's size, Tiers A and B are where the risk sits today. Tier C is out of scope until the board decides otherwise.

3. What AI may be used for. Drafting support on internal, non-client-data material only: policy drafts, internal correspondence templates, board pack assembly and report formatting. Every output is reviewed by a named person before it is used or sent.

4. What AI may not be used for. Any client data, any matter covered by legal professional privilege, or any regulated decision, until the board records a specific, minuted decision to open that use, with named controls in place.

5. Approved tools. Only tools on the approved list, held by the Head of Risk and Compliance, may be used. Requests to add a tool go through that role and the approval gate in section 3.

6. Ownership. The Head of Risk and Compliance owns this policy and reviews it quarterly. The Chief Operating Officer is accountable to the board for AI use across the firm.

7. Breach. A breach of this policy is reported to the Head of Risk and Compliance the same day it is noticed. This is a learning process, not a disciplinary trap, for the first year of use.

2. The policy suite

The AI Use Policy above is the one every member of staff reads. The pack includes five more, each built into the firm's existing policies rather than kept as a separate set:

AI Governance and Risk Management Policy. Scope, tiers, approvals, accountability and the firm's appetite for AI risk.
AI Vendor and Outsourcing Standard. Due diligence, contract terms, notice of model changes and audit rights for AI suppliers.
Model and Automation Lifecycle Standard. How any AI in use is tested, monitored and changed.
Privacy and AI Standard. When a data protection impact assessment is needed, safeguards on automated decisions, and transparency to clients.
AI Incident Response Playbook. The types of AI failure, who is told, and when the regulator must be notified.

3. Controls supporting delivery

Preventive: stop problems before they start

AI register and approval gate. Every AI tool and use is recorded in one register with its owner, purpose, data types and vendor, and rated low, medium or high risk. Medium and high uses need sign-off from the COO and the Head of Risk and Compliance before they start.
No client data boundary. Every approved use is checked against a simple test before it starts: does this touch client data or privileged material? If yes, it is not in scope yet.
A person makes every material decision. No decision affecting a client, such as onboarding, risk rating or a fiduciary decision, is made by AI alone. AI is decision support, a named role decides, and the reasoning is recorded.
AI vendors treated as outsourcing. Where an AI supplier could disrupt regulated activity, it goes through the firm's outsourcing process: due diligence, contract terms, change notice, audit rights and an exit plan.

Detective: find problems early

Human-in-the-loop on every output. No AI-drafted material reaches a client, a regulator or the board without a named person checking it against source first. This is written into each opportunity's business deliverable in the companion roadmap, not left implicit.
Unapproved use checks. Tools in use are reconciled to the register each quarter, so staff are not "left with this AI" and no guidance, a pattern seen across the sector.
Monthly reporting. The COO reports use, near-misses and progress against the roadmap to the board monthly, so the plan does not go quiet after month one.

Corrective: fix problems fast

Authority to switch off. The COO or the Head of Risk and Compliance can suspend any AI tool or roll it back immediately, and fall back to the manual process.
AI incident path. An AI failure is triaged the same day: is there client or regulatory impact? If yes, it is escalated to Compliance and the DPO, contained, and assessed for whether the regulator must be notified.
Quarterly policy review. The policy is reviewed every quarter against how it is actually being used, not left to age unchecked, the exact failure this policy is designed to avoid.

4. Governance, sized for a 32-person firm

No new committee. AI becomes a standing item on the agenda of the existing risk committee, and the board receives a short AI report each month.

Role	AI responsibility
The Board	Signs off the roadmap and the firm's appetite for AI risk; decides if and when client-matter use opens; receives the monthly AI report.
Chief Operating Officer	Accountable executive. Owns the roadmap, its delivery and its results; approves new medium and high-risk uses.
Head of Risk and Compliance	Owns the policy and the register; challenges each new use; tests the controls as part of compliance monitoring.
Data Protection Officer	Reviews data protection impact assessments and safeguards on automated decisions; handles privacy incidents.
Opportunity owners	Run each AI use day to day, check its output and report issues, as named in the companion roadmap.

5. Regulatory anchors

This framework is built on the rules Small Rock already works under, not a separate AI rulebook: the JFSC Trust Company Business Code of Practice, the JFSC Outsourcing Policy, the JFSC's cyber incident reporting expectations, and the Data Protection (Jersey) Law 2018, including its rules on automated decisions and impact assessments. Where Jersey sources are not specific to AI, recognised frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework are used as good-practice reference points.

← Return to home page · Read the AI Implementation Roadmap →