Worked example: taking apart a real-looking policy

Below is a composite AI policy of the kind that passes committees. Six clauses. We will read each one for what it actually requires, then work out what a person in the business still does not know.

Clause 1

The organisation is committed to the responsible, ethical and human-centred use of artificial intelligence.

Pile: aspiration. No action follows. Useful only as leverage in an argument. Nobody can breach it.

Clause 2

Employees must not input confidential or personal information into generative AI tools.

Pile: rule, and the first real one. Two gaps. It does not define confidential, which in most organisations quietly means whatever the reader decides. And it addresses only generative tools, so a predictive scoring service that ingests customer records is untouched by the only prohibition in the document.

What a reader still does not know: whether a customer complaint is confidential, and whether an internal draft is.

Clause 3

Use of AI tools must be approved by the relevant line manager.

Pile: delegation, and a weak one. Line managers have no basis on which to decide. The clause distributes a decision to hundreds of people with no criteria, which produces inconsistency that looks like a process. It also makes the approver accountable for something they were given no way to assess.

What would fix it: criteria, or a shorter list of approvers with the context to apply them.

Clause 4

All AI systems shall be recorded in the AI inventory.

Pile: rule, with the operative detail missing. Who records, when, and where is the inventory? A passive shall with no named actor is the standard way an obligation becomes nobody's. In practice the entries that matter most, features arriving by vendor update, have no natural owner at all under this wording.

Clause 5

AI systems must comply with all applicable laws and regulations.

Pile: aspiration wearing a rule's clothing. It restates that law applies, which was true anyway, and transfers the work of knowing which laws to the reader. Clauses like this are common because they are unarguable in committee.

Clause 6

Incidents involving AI systems should be reported to IT support.

Pile: delegation, and the most consequential defect in the document. Three problems. Should, not must. IT support, which is equipped for outages and not for judging whether an output pattern infringes fundamental rights protections. And no timescale, in a regime where Article 73 sets deadlines of fifteen days generally, ten where a person has died, and two for a widespread infringement or serious and irreversible disruption of critical infrastructure, all running from awareness.

A report sitting in a service-desk queue as a low-priority ticket is an organisation that is aware, with the clock running, and nobody who can classify.

Scoring against the seven questions

• Which tools may I use? Not answered. No list, no location for one.
• What may I put in? Partly. Confidential and personal information, undefined, and only for generative tools.
• What must I not do with the output? Not answered at all.
• When must I record it? Stated, unimplementable. No actor, no trigger, no location.
• Who approves? Answered badly. A named role with no criteria.
• What do I do when it goes wrong? Answered wrongly. Wrong destination, no deadline, non-binding verb.
• What if I get it wrong in good faith? Silent, which people read as risk.

The three changes worth asking for

Not a rewrite. Three sentences.

Replace clause 6 with a named destination, a must, and a same-day timescale for anything that may have affected a person. Add to clause 2 a short list of what counts as confidential in this organisation, with examples from actual work. Add to clause 4 the name of the person who holds the inventory and one sentence saying that telling them is enough to have recorded something.

These three changes cost nothing and convert a document that passes review into one that works at four in the afternoon on a Tuesday.

As of 24 September 2026.