AI Security Governance Pack — Guide

AI Security Governance & Acceptable Use

Most organisations do not build AI. They use other people’s AI: an assistant inside the office suite, a forecasting feature in a system they already run, a chatbot a supplier offers, or a free tool a member of staff finds on their own. Governing that use starts with knowing what is in use. For each use, you then decide what data it may touch, who answers for it and how much checking it needs. This pack gives you the policy, the list, the decisions and the training to do that in proportion to the risk, and a position that your leadership team can act on.

Is this for you?

This pack is for you if:

• you have been asked to say yes or no to an AI tool, and you have no written rule to say it with;
• you suspect that staff already use free AI tools for work, and you cannot say which, with what data;
• a supplier has switched on an AI feature in software you already own, and nobody decided that you would use it;
• a customer, an auditor or your board has asked what you do about the EU AI Act, and you do not know which parts reach you.

The idea: govern use, in proportion

A small use with low-risk data needs a short screen and a named owner. A use that touches Confidential data, faces customers, acts on its own or decides or shapes something about a person needs an assessment and a senior decision first. A few uses are never allowed. The result is a list that the organisation keeps, with counts of what is approved, held, declined and due for review. It is never one score.

Three words carry the pack.

• AI use. One way you use an AI system, for one purpose, with one owner. One tool can have several uses. The inventory lists uses, not tools.
• Tier. How much checking a proposed use needs before it starts. Tier 1 is a screen. Tier 2 adds an assessment. Tier 3 adds an executive decision, taken by the decision-maker your procedure names. A fourth outcome, Stop, means the use is not allowed.
• Deployer. An organisation that uses an AI system under its own authority for its business. Most organisations are deployers of the AI they use.

What the law asks of an organisation that uses AI

Regulation (EU) 2024/1689, the EU AI Act, binds the operators named in Article 2(1): providers, deployers, importers, distributors, product manufacturers and authorised representatives. Article 3(4) defines a deployer as a person or body using an AI system under its authority, except in the course of a personal non-professional activity. An organisation whose staff use an assistant, a forecasting feature or a supplier’s chatbot at work is looking at the deployer test. The supplier is the provider.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, amends the Act. It was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. This pack reads the Act as amended. Five things matter to a deployer.

Those are the dates in Article 113 as amended. The high-risk duties for Annex III systems are due on 2 December 2027, not on 2 August 2026, and PF-6 warns against relying on the old date.

Three more points keep you honest.

• The guidelines are not law. The Commission has published guidelines on prohibited practices, on the definition of an AI system and on Article 50. They are non-binding, and only the Court of Justice of the European Union gives an authoritative reading of the Act. The guidelines on classifying high-risk systems are only a draft, published for consultation on 19 May 2026. Treat them as a draft.
• One proposal is not adopted. The Commission’s proposal COM(2025) 837 would amend the GDPR and related law. It was still in committee on 8 October 2026, and nothing in this pack relies on it.
• Your Member State fills gaps. Member States set penalties and name the authorities that enforce the Act. No national text was read for this pack.

Where an AI use also touches personal data, the GDPR applies as well. Data minimisation (Article 5(1)(c)) and processor terms (Article 28(1)) are the two it leans on most. If NIS2 applies to you, supply chain security (Article 21(2)(d)) and basic cyber hygiene and training (Article 21(2)(g)) cover the same ground from the supplier and the staff side.

Which “distributor”?

A business that distributes goods, such as a wholesale distributor, is not a distributor under the AI Act. The Act’s distributor makes an AI system available on the Union market. An organisation that uses AI tools in its own work is looking at the deployer test (PF-5). The example below is a wholesale distributor, and it is not an AI Act distributor.

Where the standards fit

ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, is a standard for running AI governance as a management system. It is a paid standard, and its text was not read for this pack. The pack cites three of its parts by number and title only: clause 5.2, AI policy; clause 6.1, Actions to address risks and opportunities; and Annex A control A.2.2, AI policy. They name where this pack’s policy and assessment sit in that standard. They do not say that using the pack meets the standard.

ISO/IEC 27001:2022 Annex A 5.1, Policies for information security, is the control the guide relates to. NIST CSF 2.0 GV.PO-01 and NIST AI RMF 1.0 GOVERN 1.1 are the matching outcomes in their frameworks. NIST AI RMF 1.0 is voluntary.

This pack does not say which ISO/IEC 42001 or ISO/IEC 27001 controls, or which NIST AI RMF outcomes, meet a requirement of the EU AI Act. Each reference says what the source asks for and which CISO Times document helps with that work.

The order to work in

Work through these steps in order. The first three give you control of what is already in use. The rest add the decisions, the checking and the proof.

Use the inventory in every step from the third. It is the programme (PF-1). Review the whole of it at least every 6 months, and review a single use within 10 working days of a trigger such as a new purpose, a new data level, a change of supplier or a new AI feature (AG-10).

Start with these three

1. AI System & Use Case Inventory: every use listed, with an owner, a person who checks the output, a data level and a tier. It runs ten checks over the list.
2. AI Tool Approval & Data Permission Matrix: each tool as Approved, Approved with conditions or Not approved, and the data classes each may take.
3. AI Acceptable Use & Security Policy: the rules your staff can follow, and the ones that take no exception (AG-03, AG-05).

How the checking scales

A proposal answers twelve intake questions (IQ-01 to IQ-12). The AI governance lead screens a complete request, and the answers set the tier.

Building an application or feature on a supplier’s model API counts as building, whether it is for staff or for customers; using a supplier’s finished product as supplied does not. Answering Yes to the building question is a signal and not a finding that you are a provider. It makes a new use Tier 3 and holds it until Legal records which role you hold (deployer, provider or other) with its reasoning on the worksheet. If Legal records the deployer role, the hold clears and the tier is set again from the answers, so the use does not stay at Tier 3 only because the signal was raised. If Legal records the provider role or another role, the hold clears but the use stays Tier 3, because you are then outside the deployer governance of this pack: the executive decision-maker decides, with the worksheet confirmed by Legal. In the inventory, the role clears the hold only when the worksheet row and the date of Legal’s confirmation are filled. A feature already running when you adopt the pack is not raised to Tier 3 by the signal; it carries the hold as a condition with a date until Legal records the role.

A use that only informs a decision about a person is Tier 2. A use that decides or shapes one, or that falls in an area of Annex III whatever it does, is Tier 3. Nobody approves a use they own: the use owner is consulted and signs the conditions it accepts. Where a tier’s approver owns the use, the executive decision-maker takes that approver’s place. The AI governance lead may suspend an approved running use pending review, and the approvers of its tier decide whether it resumes. A Critical risk is never accepted by executive management as such: it goes to the board or its equivalent.

These tiers, the days to decide and the review months are house defaults that you set for yourself in the documents.

How it runs in practice (EXAMPLE)

Take the distributor of the earlier packs: a wholesale distributor with about 900 staff, three warehouses and an online ordering service. It is not a financial entity and it is an important entity under NIS2. Its Executive Committee approved the AI policy on 11 August 2026, and the literacy plan launched on 1 September. The approved tool list was issued on 4 September.

From 14 to 25 September an inventory survey of AI use ran. It found seven uses.

• AI-001, the office suite assistant. Staff use it to draft and summarise internal text. It is Tier 1 and was approved with conditions on 2 September.
• AI-002, forecasting in the warehouse system. The survey found it as a feature in the supplier’s 2025 release. It is Tier 2, assessed on 24 September and approved with conditions on 28 September. If the supplier’s assessment under P06 does not end in approval by 20 October, the module is switched off.
• AI-003, a customer-service chatbot. The contact centre proposed it. It is Tier 3 and was assessed on 23 September. On 29 September the Executive Committee held it until the contact centre’s assessment under P06 (planned for 1 December 2026) is done, the contract bars training on the distributor’s data, processor terms are signed and the Data Protection Officer has advised on a data protection impact assessment.
• AI-004, an image generator in the design tool. It is Tier 1, approved with conditions for Public information only, with no realistic images of real people, sites or products.
• AI-005, a free public assistant on personal accounts. Four Marketing staff used it for draft campaign wording. It is not an approved tool. They had put in only Internal information, and the survey found no personal data and no Confidential files. It was reported as an event through the incident route on 18 September, found not to be an incident and stopped on 21 September, the next working day. The four moved to the approved assistant and completed the AI essentials module.
• AI-006, machine-learning detection in the managed security monitoring service. It was running before the policy. It is Tier 2 and approved with conditions, and its assessment is due by 24 December 2026.
• AI-007, a job-applicant ranking add-on that HR proposed. The AI governance lead and the HR Director declined it at screening on 22 September. The distributor’s own reading puts it in Annex III point 4, and it ranks and profiles candidates. Counsel confirmed that reading. The deployer duties start on 2 December 2027, and the distributor could not meet them for a recruitment system now. HR can propose it again.

On 30 September the leadership team saw five measures as counts.

Of the seven audiences in the literacy plan, two are complete. Customer service staff are not yet due, because the chatbot is held.

Read the reasoning for each use as the distributor’s own record. It does not say that any of its systems is, or is not, in a category of the Act. Counsel confirms each conclusion.

Your first month

What to report

Report these every month as counts with names, to the security and IT leadership team (AG-22):

• uses with a current approval, and those without, by name;
• Tier 2 and Tier 3 uses with a completed assessment, and those waiting;
• approvals past their review date;
• people with an AI tool who completed AI essentials, and the others, by group;
• unapproved uses found, and how many were stopped within 3 working days.

Report counts such as 4 of 5. Never combine the measures into a percentage, a score or a traffic-light total. Show training results only for groups of at least 10 people (P16).

Everything in the pack

Limits

• Not legal advice. This pack helps you govern the AI your organisation uses. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts and on how your Member State applies the Act. Confirm it with counsel.
• No classification. The worksheet records your own reasoning against the text of the Act. It does not say that any system is or is not prohibited, high-risk or subject to a transparency duty, and it does not say that you are a provider, a deployer or any other operator. Counsel confirms each conclusion.
• No mapping. The pack does not say which ISO/IEC 42001 or ISO/IEC 27001 controls, or which NIST AI RMF outcomes, meet a requirement of the EU AI Act. Using a document does not by itself show that a requirement is met.
• Incidents and reporting belong to other packs. The incident management pack (P09) owns the reporting route, the no-blame rule and the response. The regulatory incident notification pack (P18) holds reporting duties and clocks. This pack names only the AI-specific triggers that hand an event over (AT-1 to AT-8) and states no clock.
• Other packs own the rest. The classification pack (P15) owns the data levels. The third-party pack (P06) owns supplier assessment and contract clauses. The risk pack (P05) owns the impact and likelihood scales. The awareness pack (P16) owns the baseline course, which this pack’s literacy plan sits beside and does not change.
• The law is moving. The pack reads the Act as amended on 8 October 2026. The draft guidelines on classifying high-risk systems and the proposal COM(2025) 837 are not adopted. Check for change at each review.
• National law and your authority. The authorities, the penalties, any national rules on monitoring staff and the rights of staff representatives are placeholders that you fill from your own law. Nothing national was read for this pack.
• The files are yours. Every policy, register, matrix and plan in the pack is a file you keep on your own systems. Nothing you enter in them goes back to the CISO Times.
• The example is not a real firm. The distributor is a fictional example, marked EXAMPLE, and every value in it is made up.

Where it maps

• EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744: Articles 2(1), 3(1), 3(4), 4, 5(1), 26(1), 50(1) and 113.
• ISO/IEC 42001:2023: clause 5.2, AI policy; clause 6.1, Actions to address risks and opportunities; Annex A control A.2.2, AI policy. By number and title only.
• ISO/IEC 27001:2022: Annex A 5.1, Policies for information security. This names the control the guide relates to. It does not say that meeting it meets any requirement of the EU AI Act.
• NIST CSF 2.0: GV.PO-01. NIST AI RMF 1.0: GOVERN 1.1.
• GDPR: Articles 5(1)(c) and 28(1). NIS2: Articles 21(2)(d) and 21(2)(g).