What you can put into practice
- A tailored staff policy, owner procedure and contact card.
- A workflow inventory and scoped approval records.
- Configuration evidence and claim-by-claim output review records.
- Separate records for exceptions, suspected incidents and changes.
- Training observations and periodic reviews with follow-through actions.
- A tailored staff policy, owner procedure and contact card.
- A workflow inventory and scoped approval records.
- Configuration evidence and claim-by-claim output review records.
- Separate records for exceptions, suspected incidents and changes.
- Training observations and periodic reviews with follow-through actions.
The templates provide structure; your team supplies the local facts, evidence and decisions.
Where this guidance helps
- Introduce a first, narrowly defined AI workflow with named owners and a manual fallback.
- Document existing AI use and distinguish approved workflows from unapproved activity.
- Turn broad policy statements into observable input, account, review and reporting rules.
- Train staff through realistic decisions, corrections and recorded observations.
- Introduce a first, narrowly defined AI workflow with named owners and a manual fallback.
- Document existing AI use and distinguish approved workflows from unapproved activity.
- Turn broad policy statements into observable input, account, review and reporting rules.
- Train staff through realistic decisions, corrections and recorded observations.
Tools you can adapt
Editable documents Staff policy, owner procedure and contact card. Spreadsheet-ready records Use register, use approval, configuration, output review, exception, incident, training, change and periodic review. CSV files contain no formulas or macros. Markdown files are editable text. Keep blank templates separate from the completed fictional examples.Editable documents
Staff policy, owner procedure and contact card.
Spreadsheet-ready records
Use register, use approval, configuration, output review, exception, incident, training, change and periodic review.
CSV files contain no formulas or macros. Markdown files are editable text. Keep blank templates separate from the completed fictional examples.
Fictional examples, practical decisions
Case A: a six-person studio. Work through an approval packet, a flawed draft and corrected output, training remediation, a denied exception and three change decisions. Case B: a service business. Follow the discovery of unapproved use, an incident with unresolved assessment, a narrower alternative, corrected complaint output and retraining. Both cases are fictional. Their completed records illustrate the process; they are not evidence about your organization.Case A: a six-person studio. Work through an approval packet, a flawed draft and corrected output, training remediation, a denied exception and three change decisions.
Case B: a service business. Follow the discovery of unapproved use, an incident with unresolved assessment, a narrower alternative, corrected complaint output and retraining.
Both cases are fictional. Their completed records illustrate the process; they are not evidence about your organization.
Inside the handbook
View the handbook contents +
- What this handbook helps you finish
- Establish authority before writing rules
- Find actual use and the unmet business need
- Classify decisions with observable boundaries
- Adoptable model staff policy
- Owner procedure from request to retirement
- Build an approval record that someone else can audit
- Make account and information boundaries observable
- Set up safe practice before live use
- Review outputs as claims and consequences
- Handle exceptions and suspected incidents differently
- Case A: the six-person studio input and decision packet
- Case A: flawed draft, corrected output and review evidence
- Case A: three changes and an evidence-based closeout
- Case B: a service business discovers shadow use
- Case B: redesign, rejection and retraining
- Staff self-paced learning path
- Reviewer and manager learning path
- Administrator learning path and handoff
- Troubleshoot the policy where work actually breaks
- Roll out, maintain and measure without creating busywork
- Use the toolkit and understand the evidence limits
How this report was prepared
Created using generative AI and reviewed through source and consistency checks. The policy wording, roles, record structures, examples and exercises are original educational recommendations informed by bounded concepts in NIST, NCSC and European Commission guidance. The edition records a source recheck date of October 21, 2026. This is distinct from independent verification or a compliance assessment. Source organizations do not endorse the publication. The exercises are author desk simulations using fictional materials, not tests of a real model, vendor, account or workforce.Created using generative AI and reviewed through source and consistency checks. The policy wording, roles, record structures, examples and exercises are original educational recommendations informed by bounded concepts in NIST, NCSC and European Commission guidance.
The edition records a source recheck date of October 21, 2026. This is distinct from independent verification or a compliance assessment. Source organizations do not endorse the publication.
The exercises are author desk simulations using fictional materials, not tests of a real model, vendor, account or workforce.
Scope and limitations
Educational guidance, not legal advice, certification or a professional security assessment. No guarantee of security, compliance or prevention of loss. Adapt the material to your systems, industry and jurisdiction, verify real configurations and obtain appropriate local review before adoption.Questions before you begin
Do we need a live AI account for the exercises? No. The supplied exercises use fictional, inert materials and can be completed offline or in an authorized local editor. Do not upload real personal or business records to complete them. Can we adopt the completed policy by changing our business name? No. Start from the blank templates. Replace the fictional people, routes and settings with your own approved scope, evidence and responsibilities. Is this just a policy document? No. It combines a handbook with editable policy documents, decision records, practical cases and training assignments. The aim is to connect written rules to day-to-day approvals, review and reporting. Does completing the training certify our team or prove compliance? No. The practice records show decisions within fictional exercises. They do not certify staff, validate a real system or establish legal compliance. How are the 12 tools and 53 pages counted? There are 12 distinct template families, each with a blank and completed example. The three PDFs total 53 pages. Word copies and paired examples are not counted as extra tool families or additional PDF reading pages.Do we need a live AI account for the exercises?
No. The supplied exercises use fictional, inert materials and can be completed offline or in an authorized local editor. Do not upload real personal or business records to complete them.
Can we adopt the completed policy by changing our business name?
No. Start from the blank templates. Replace the fictional people, routes and settings with your own approved scope, evidence and responsibilities.
Is this just a policy document?
No. It combines a handbook with editable policy documents, decision records, practical cases and training assignments. The aim is to connect written rules to day-to-day approvals, review and reporting.
Does completing the training certify our team or prove compliance?
No. The practice records show decisions within fictional exercises. They do not certify staff, validate a real system or establish legal compliance.
How are the 12 tools and 53 pages counted?
There are 12 distinct template families, each with a blank and completed example. The three PDFs total 53 pages. Word copies and paired examples are not counted as extra tool families or additional PDF reading pages.