AI POLICY AND ACCEPTABLE USE
An AI policy that says what is allowed, what needs approval, and who decides.
A policy is the written form of decisions already made: what staff and vendors may do with AI, what needs whose approval, what is not allowed, and how a new use is added.
At a glance
- Unit
- The policy set on this page
- Also in
- The AI Governance Assessment
- Fee and duration
- In writing, before you sign
Use it when
A policy of principles with no operating path is ignored the first time a team finds something that saves an afternoon.
- The board or a counterparty asked for the policy, and there is none, or a prohibition nobody follows.
- Nobody can say which uses need review, what to submit, or who approves.
- The policy covers chat tools, not AI inside contracted products.
Six deliverables, written to your tiers
| Deliverable | What it holds |
|---|---|
| AI Policy | Purpose, scope, definitions, roles, rules by tier, approvals, exceptions, monitoring, maintenance |
| Acceptable Use Guide | For the desk, not the auditor: approved tools, what may go in, what never may |
| Intake Record | The Program's six gate answers, routing a proposed use to its approver |
| Exception Record | Decision, owner, conditions, expiration, review date and rationale |
| Staff Briefing Set | Role specific messages and worked examples for launch |
| Maintenance Schedule | Triggers as uses, vendors or requirements change; a named owner; the annual review |
Without Assessment tiers, the tiering questions go into the policy. The guide says what to do when unsure, and is short enough to be read. A use the policy does not cover goes through the Intake and Exception Records to its tier's approver; the maintenance owner amends a recurring gap.
- approve
- approve with conditions
- pilot
- restrict
- defer pending evidence
- escalate
- reject
- suspend
- retire
Every decision uses one of these nine words and records the rationale, the approver, the conditions, the expiration and the trigger for reassessment.
A policy with no maintenance owner is current on the day it is signed and on no day after.
Four steps; tested before adoption
- Read what happens now: uses, current policy, who decides, enforcement. Fee and duration in writing first.
- Draft around action: what a person does, asks and records. An unresolved legal question is marked for counsel rather than written around.
- Test on real scenarios with staff, managers, security, privacy, legal and procurement as they apply; fill each blank.
- Launch with an owner: briefings, exceptions and triggers agreed before adoption; the set is signed off before it leaves this firm.
We need your named approvers, current policies, any list of AI uses, a person per business area, and time for the test.
Where a written policy is asked for by name
Freddie Mac Guide Section 1302.8 and Fannie Mae LL-2026-04
LL-2026-04: written policies and procedures with a designated owner who reviews them at least annually. 1302.8: policies, processes and procedures for mapping, measuring and managing AI risk.
- Requires
- Freddie Mac Guide 1302.8, from 3 March 2026, and Fannie Mae LL-2026-04, from 6 August 2026, require a Seller/Servicer using AI or machine learning in origination or servicing to hold a written governance framework for it.
- Reaches
- Any size, through the contract.
- Not
- Anyone outside either contract.
NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers
The policy is the written core of the board overseen AI systems program it expects.
- Reaches
- Insurers in a state whose department adopted it, with that state's variations.
- Status
- Guidance, not statute.
- Not
- Insurers in a state that has not adopted it. Whether it reaches producers, managing general agents or third party administrators is a state question.
For banks, credit unions and nonbank mortgage companies, the policy's vendor rules sit inside third party oversight already owed, and it is the document an examiner asks for. The rest is on AI Governance.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
Where we stop
Red Stick Solutions drafts the policy and facilitates its approval. It does not adopt policy for you: the executive, legal, privacy, human resources and business owners you name review the language before adoption, and this firm makes no employment or legal determinations.
A policy alone controls nothing. This engagement has a finish line; the AI Governance Program runs briefing, intake, monitoring and the annual review.
Before you sign
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| If it stops | You keep everything produced to that point, in the form it is in that day. |
| Is this the Assessment's policy? | Yes. Nobody buys it twice, and an organization that has had the Assessment does not need this engagement. |
Tell us what the policy has to decide, and who approves it.
The first reply says whether the policy set is enough or the inventory comes first.
- Unit
- The policy set on this page
- Fee
- Fixed against this scope, in writing, in the first conversation, before you sign or grant access.
- Duration
- Elapsed time and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.