Generative AI Policy Starter Template

Q: What should a generative AI policy include?

A comprehensive generative AI policy should include: approved tools and platforms, acceptable use guidelines, data classification rules, intellectual property considerations, security requirements, human review requirements, training programs, compliance enforcement procedures, and governance structures.

Q: What percentage of companies have formal AI policies?

Survey results vary, but a consistent pattern remains: employee use of generative AI often outpaces formal enterprise policy, which creates shadow-AI and data-governance risk.

Why You Need a Generative AI Policy

The absence of formal generative AI policies creates four critical risk categories that every organization must address:

1. Data Exposure and Confidentiality Breaches

Samsung Semiconductor Code Leak (April 2023)

Samsung engineers pasted sensitive material into ChatGPT, including source code and meeting content. Samsung then restricted internal use of generative AI tools and explored more controlled internal alternatives.^[3]

When employees lack approved tools, they use whatever is readily available. Consumer AI products also differ materially in how they retain prompts and whether data may be used for model improvement, which means policy teams need tool-specific guidance rather than one blanket assumption about ChatGPT, Claude, or Gemini.^[2]

2. Intellectual Property Contamination

AI-generated content creates murky IP ownership questions. The U.S. Copyright Office maintains that only human-created works qualify for copyright protection, meaning purely AI-generated content may not be copyrightable. For organizations selling software or creative works, this creates massive risk.^[7]

Additionally, AI systems trained on copyrighted material face ongoing litigation. The New York Times sued OpenAI and Microsoft, Getty Images sued Stability AI, and authors and artists have filed class actions. Those cases do not automatically transfer liability to every enterprise user, but they do illustrate why policy teams should track provider terms, output-review practices, and evolving case law.^[8]

3. Regulatory and Compliance Violations

Sector-specific regulations create AI-specific compliance obligations:

Regulatory Requirements by Sector

Sector	Regulation	AI-Specific Requirements
Healthcare	HIPAA	Determine the parties’ actual HIPAA roles and PHI data flows; a BAA is required when the vendor is acting as a business associate for the covered function
Financial Services	GLBA, FCRA, ECOA	Fair lending laws prohibit algorithmic discrimination; explainability required for adverse actions
EU Operations	EU AI Act	Risk assessments, conformity declarations, and quality management systems for covered high-risk AI. Relevant Annex III duties apply from 2 December 2027 under the AI Omnibus in force since 27 July 2026.
Colorado (US)	Colorado SB 26-189 (ADMT)	SB 24-205 was repealed and replaced by SB 26-189 (“Automated Decision-Making Technology”), signed 14 May 2026. Pre-use notice, post-adverse-outcome disclosure, data-correction and human-review rights apply to covered automated decision-making technology used to materially influence a consequential decision. Substantive compliance from 1 January 2027.

4. AI Hallucinations and Malpractice Liability

Mata v. Avianca (May 2023)

Attorney Steven Schwartz used ChatGPT to research case citations. ChatGPT hallucinated six fake cases with realistic-sounding names, docket numbers, and quotes. Schwartz filed them with federal court, and the judge sanctioned him for relying on fabricated citations. The case is a validation failure and sanctions example, not a malpractice ruling.^[4]

In legal services, hallucinations and heavy verification burdens remain recurring adoption concerns. That is exactly why policy language should require independent source checking before any filing or client-facing legal work.^[9]

Policy Scope & Applicability

Effective AI policies clearly define who they cover, what systems they govern, and what use cases they address.

Who Is Covered

AI policies should apply to:

All employees, contractors, and consultants with access to company systems or data
Third-party vendors processing company data through AI systems
Partners and collaborators with data-sharing agreements

What Systems Are Governed

Policies should cover:

Generative AI tools: ChatGPT, Claude, Gemini, Copilot, Midjourney, and similar systems
Code generation tools: GitHub Copilot, Cursor, Replit, Amazon CodeWhisperer
AI business tools: Sales assistants, customer service bots, marketing content generators
Third-party AI integrations: Plugins, APIs, or embedded AI in SaaS platforms

What Use Cases Are Addressed

Policies should distinguish between:

Permitted Use Cases

Draft internal documentation
Research and learning
Code assistance (non-production)
Content brainstorming

Prohibited Use Cases

Processing customer PII
Generating legal/medical advice
Automated decision-making
Training on proprietary code

Approved Tools & Platforms

Organizations should maintain a whitelist of approved AI tools that meet security, privacy, and compliance requirements.

Whitelist Approach

The whitelist model provides several advantages:

Centralized procurement: Negotiate enterprise agreements with better pricing, security terms, and data protections
Security vetting: Conduct vendor security assessments before organization-wide deployment
Usage monitoring: Track adoption, costs, and potential misuse through centralized billing
Legal and contractual alignment: Determine applicable duties from the organization’s role and data flows, including whether a HIPAA BAA or a particular transfer/localization mechanism is required

Procurement Requirements

Before approving any AI tool, require vendor documentation including:

Data Processing Agreement (DPA)
GDPR-compliant terms specifying data handling, retention, deletion procedures
Business Associate Agreement (BAA)
Required between the applicable parties when the vendor performs a covered function as a HIPAA business associate; confirm roles and PHI data flows first
Security Questionnaire / SOC 2 Report
Independent validation of security controls, access management, encryption
Training Data Transparency
Disclosure of whether user inputs train models and how to opt out

Acceptable Use Guidelines

Clear acceptable-use guidelines can reduce common policy violations while enabling productive AI adoption, but effectiveness depends on training, controls, monitoring, enforcement, and the workflow.

What’s Allowed

Permitted Activities

Research and exploration: Learning how AI tools work, understanding capabilities and limitations
Draft creation: Initial drafts of internal documentation, emails, presentations (subject to human review)
Code assistance: Syntax help, debugging suggestions, code explanation (for approved development tools only)
Data analysis: Analyzing anonymized, non-confidential datasets for insights
Translation and summarization: Translating public content or summarizing non-confidential documents
Creative brainstorming: Generating ideas, concepts, or creative alternatives

What’s Prohibited

Prohibited Activities

Confidential information: Inputting trade secrets, source code, proprietary algorithms, customer lists, or strategic plans
Personal data: Processing PII, PHI, financial data, or other regulated data without approved safeguards
Legal/medical advice: Using AI to generate legal opinions, medical diagnoses, or professional advice
Automated decision-making: Using AI outputs for employment, lending, insurance, or other consequential decisions without human review
Bypassing security controls: Using personal accounts to circumvent organizational AI restrictions
Plagiarism or misrepresentation: Presenting AI-generated content as original human work without disclosure
Harmful content generation: Creating discriminatory, defamatory, or illegal content

Data Classification & Handling

Organizations should implement a data classification framework that governs what data can be processed through AI systems.

Four-Tier Classification Model

Data Classification for AI Use

Classification	Definition	AI Use Permitted	Examples
Public	Publicly available information	Yes (any approved tool)	Published blog posts, marketing materials, press releases
Internal	Non-public but non-sensitive	Limited (enterprise tools only)	Meeting notes, project plans, internal wikis
Confidential	Business-sensitive information	Prohibited (except approved private deployments)	Source code, customer lists, financials, roadmaps
Restricted	Regulated or legally protected	Prohibited (exception requires legal approval)	PII, PHI, payment data, MNPI

Special Handling for Regulated Data

Organizations in regulated industries must implement additional controls:

Healthcare (HIPAA)

AI tools that create, receive, maintain, or transmit PHI on behalf of a covered entity generally require a BAA. Consumer AI tools should be treated as out of scope for PHI unless the organization has separately verified HIPAA-ready terms and configurations. HIPAA does not require on-prem deployment, but it does require appropriate contractual, security, and risk-management controls.^[10]

Financial Services

GLBA, FCRA, and fair lending laws prohibit discrimination in credit decisions. AI used in lending, insurance pricing, or account management should be reviewed for fairness risk, documentation quality, and adverse-action explainability obligations.^[11]

EU/International Operations

GDPR requires data-processing agreements where a vendor acts as a processor of EU personal data. The EU AI Act requires conformity assessment, risk management, and quality management systems for covered high-risk AI. Under the AI Omnibus in force since 27 July 2026, relevant Annex III duties apply from 2 December 2027. Separate legal or contractual requirements may affect hosting location.^[12]

Intellectual Property Considerations

AI-generated content creates complex IP ownership questions that organizations must address proactively.

Copyright and Ownership

The U.S. Copyright Office maintains that only works created by humans are copyrightable. AI-generated content without substantial human authorship may lack copyright protection, creating risk for organizations selling software, content, or creative works.^[7]

Copyright Office Guidance (March 2023)

The Copyright Office clarified that works generated entirely by AI without human creative input are not copyrightable. However, works where humans select, arrange, or modify AI outputs with creative judgment may qualify. Organizations that care about authorship claims should document meaningful human contribution and review.^[7]

Licensing and Third-Party IP

AI systems trained on copyrighted material face ongoing litigation. Organizations must assess exposure:

Training data lawsuits: NYT vs. OpenAI, Getty vs. Stability AI, Authors Guild class actions all allege unauthorized use of copyrighted training data^[8]
Output similarity: AI tools may reproduce copyrighted material verbatim, exposing users to infringement claims
Vendor indemnification: indemnification varies materially by provider, plan, and contract, so policy teams should review current terms rather than assume coverage

Policy Recommendations

Require human authorship: All AI-generated content must undergo substantial human review, editing, and creative input to preserve copyright eligibility
Mandate disclosure: Customer-facing content must disclose AI involvement where legally required or when material to the transaction
Prohibit code copying: Ban directly copying AI-generated code into production without license verification and security review
Document AI use: Maintain records of which content used AI assistance to support copyright registration or defend infringement claims

Security Requirements

AI tools introduce unique security risks beyond traditional SaaS applications. Policies must address authentication, access controls, data retention, and monitoring.

Authentication and Access Control

SSO integration: All enterprise AI tools must support SAML or OIDC single sign-on
MFA enforcement: Multi-factor authentication required for all AI tool access
Role-based access: Limit access to AI tools based on job function and data classification clearance
Personal account prohibition: Ban use of personal AI accounts (personal Gmail ChatGPT, etc.) for work purposes

Data Retention and Deletion

Opt out of training: Disable model training on user inputs for all approved enterprise tools
Conversation history limits: Configure tools to delete conversation history after 30/60/90 days based on data sensitivity
Data residency: Ensure data processing occurs in approved geographic regions (critical for GDPR, China data laws)
Deletion terms: Define the deletion rights, response time, exceptions, and verification evidence required by applicable law and the negotiated contract; do not assume a universal 30-day rule

Logging and Monitoring

Enterprise AI deployments should use purpose-appropriate, data-minimized logging derived from investigation needs, system risk, and applicable obligations. Full prompts and outputs can materially expand sensitive-data exposure; omit, redact, tokenize, or separately protect payloads unless their retention is justified.

Audit trails: Record the events, actor or role references, timestamps, control outcomes, and payload references needed for the defined purpose; avoid retaining raw prompts or outputs by default
Anomaly detection: Alert on unusual usage patterns (bulk queries, off-hours access, data exfiltration attempts)
DLP integration: Integrate with Data Loss Prevention (DLP) tools to block PII, secrets, or credentials in AI inputs

Human Review Requirements

Human oversight should be designed for the activity, consequence, jurisdiction, professional duty, system role, and assessed risk. The examples below are illustrative starting points, not universal mandates or statements of law.^[13]

Illustrative Human Review Scenarios

Example Review Defaults to Tailor

Use Case	Review Requirement	Rationale
Legal filings/opinions	Review by the responsible attorney; verify facts and authorities as professional duties require	Courts have already sanctioned lawyers for unverified AI-generated citations (Mata v. Avianca)^[4]
Medical advice/diagnoses	Licensed-clinician review where the workflow, standard of care, law, or risk requires it	Clinical workflow, professional duty, patient-safety risk, and applicable law
Employment decisions	Qualified HR or legal review and appropriate bias testing where required	Decision role, anti-discrimination law, policy, and assessed impact
Credit/lending decisions	Qualified review, appeal, or override path and a specific-reasons process where applicable	Applicable adverse-action and fair-lending law, automation level, and risk
Customer-facing content	Subject-matter or risk review where organizational policy or exposure warrants it	Audience, claim sensitivity, brand policy, and legal or safety exposure
Production code	Risk-based code, security, and license review with testing appropriate to the change	Change criticality, deployment authority, security exposure, and license obligations

Verification Standards

Human reviewers must be trained to:

Verify factual claims: Check citations, statistics, case law references against original sources
Assess bias and fairness: Evaluate outputs for discriminatory language, stereotypes, or disparate impact
Check brand/voice alignment: Ensure content matches organizational standards, tone, and policies
Document review process: Maintain audit trail showing who reviewed, what changed, and approval timestamp

Training & Awareness

Effective AI policies require comprehensive training programs to ensure employees understand rules, risks, and approved workflows.

Required Training Components

Initial Onboarding (All Employees)

Overview of organizational AI policy
Approved vs. prohibited tools
Data classification and handling rules
How to request new AI tool approvals
Reporting suspected policy violations

Role-Specific Training

Developers: Secure coding with AI assistants, license compliance, security testing
Legal/Finance: Hallucination verification, citation checking, professional liability
Healthcare: HIPAA requirements, BAA verification, patient data protections
Marketing/Sales: Brand guidelines, IP ownership, customer disclosure requirements
Managers: Monitoring team AI use, escalation procedures, policy enforcement

Ongoing Awareness

Quarterly policy updates as new tools/regulations emerge
Case studies of AI incidents (Samsung breach, Mata v. Avianca)
New tool announcements and training
Annual policy recertification

Compliance & Enforcement

Policies without enforcement mechanisms fail. Organizations must define violations, consequences, and escalation procedures.

Violation Categories

Critical Violations (Immediate Investigation)

Processing restricted data (PII, PHI, payment data) through unauthorized tools
Intentionally bypassing security controls or data loss prevention systems
Exposing trade secrets, source code, or confidential business information
Using AI for illegal, discriminatory, or harmful purposes

Moderate Violations (Manager Review)

Using non-approved AI tools without malicious intent
Processing confidential (but not restricted) data without proper safeguards
Failing to disclose AI use when required
Skipping required human review processes

Minor Violations (Training/Warning)

Using approved tools for unapproved use cases due to lack of awareness
Incomplete documentation of AI-generated content
Delayed compliance with new policy updates

Progressive Discipline Framework

Consequences should be proportional to violation severity:

First minor violation: Documented verbal warning + mandatory retraining
Second minor or first moderate: Written warning + performance plan
Repeated moderate violations: Suspension + final written warning
Critical violation: Immediate suspension pending investigation; termination for cause if substantiated

Policy Governance

AI technology evolves rapidly. Policies require regular review, clear ownership, and stakeholder input to remain effective.

Governance Structure

Policy Owner: Chief Information Security Officer (CISO) or Chief Compliance Officer maintains and updates policy
AI Governance Committee: Cross-functional team (Legal, Security, IT, Business, HR) reviews quarterly
Executive Sponsor: C-level executive (CTO, CIO, General Counsel) approves major policy changes

Review Cycles

Quarterly reviews: Assess new AI tools, regulatory changes, incident learnings
Annual comprehensive review: Full policy refresh with stakeholder input
Emergency updates: Triggered by critical security incidents, regulatory actions, or major vendor changes

Starter Policy Template

The following starter provides adaptable sections, not a ready-made compliance program. Tailor it to the organization’s activities, jurisdictions, professional duties, privacy and security architecture, decision rights, risk tolerance, approved tools, and applicable law and contracts before adoption.

Starter Generative AI Acceptable Use Policy

GENERATIVE AI ACCEPTABLE USE POLICY: STARTER ONLY TAILORING NOTE: All roles, classifications, controls, review defaults, timeframes, and enforcement steps below are illustrative. Validate them for the organization’s activities, jurisdictions, professional duties, privacy and security architecture, contracts, and risk before adoption. Policy Owner: [Chief Information Security Officer] Effective Date: [Date] Last Reviewed: [Date] Version: 1.0 1. PURPOSE This policy establishes requirements for the acceptable use of generative artificial intelligence (AI) tools within [ORGANIZATION NAME]. It aims to enable productive AI adoption while protecting confidential information, ensuring compliance with applicable laws, mitigating security risks, and maintaining intellectual property rights. 2. SCOPE This policy applies to: • All employees, contractors, consultants, and temporary workers • All generative AI tools and services accessed using organization resources or for organization business • All data and content created, processed, or transmitted using AI systems 3. APPROVED TOOLS The following AI tools have been approved for use at [ORGANIZATION]: Enterprise Tools (Confidential Data Permitted): • [Tool 1] - Use cases: [Description] • [Tool 2] - Use cases: [Description] General Tools (Public/Internal Data Only): • [Tool 3] - Use cases: [Description] Request approval for new AI tools via [PROCESS]. 4. ACCEPTABLE USE PERMITTED activities include: ✓ Research, learning, and skill development ✓ Drafting internal documentation (subject to review) ✓ Code assistance for approved development tools ✓ Analyzing anonymized, non-confidential data ✓ Translating or summarizing public content ✓ Creative brainstorming and ideation PROHIBITED activities include: ✗ Processing confidential or restricted data without approved safeguards ✗ Inputting PII, PHI, financial data, or trade secrets into unapproved tools ✗ Using AI to generate legal opinions, medical diagnoses, or professional advice ✗ Automated decision-making for employment, lending, or other consequential decisions ✗ Bypassing security controls or using personal AI accounts for work ✗ Presenting AI content as original human work without disclosure ✗ Generating discriminatory, defamatory, or illegal content 5. DATA CLASSIFICATION AI use must comply with data classification standards: PUBLIC: Any approved AI tool permitted INTERNAL: Enterprise AI tools only CONFIDENTIAL: Prohibited except approved private deployments RESTRICTED (PII/PHI/Financial): Prohibited without legal/compliance approval 6. SECURITY REQUIREMENTS • Single Sign-On (SSO) and multi-factor authentication (MFA) mandatory • Personal AI accounts prohibited for organization business • Disable model training on organization inputs • Configure conversation history retention per data classification • Report security incidents to [SECURITY TEAM] within [X] hours 7. INTELLECTUAL PROPERTY • AI-generated content must undergo substantial human review and editing • Document which content used AI assistance • Verify AI-generated code does not violate licenses before production use • Disclose AI involvement in customer-facing content where required by law 8. HUMAN REVIEW AND ESCALATION Define qualified review, approval, appeal, or escalation where the activity, consequence, jurisdiction, professional duty, organizational policy, or assessed risk requires it. Illustrative scenarios to evaluate include: • Legal filings, contracts, or legal opinions • Medical advice or clinical documentation • Employment, lending, or insurance decisions • Customer-facing content before publication • Production code before deployment 9. TRAINING • All employees complete AI policy training within [X] days of hire • Role-specific training for high-risk functions (legal, healthcare, finance) • Annual recertification required • Quarterly updates on new tools and regulations 10. VIOLATIONS AND ENFORCEMENT Critical violations (restricted data exposure, intentional security bypass): → Immediate investigation; potential termination Moderate violations (unapproved tools, missing human review): → Written warning + performance plan Minor violations (lack of awareness): → Documented verbal warning + retraining 11. GOVERNANCE • Policy Owner: [CISO / Chief Compliance Officer] • Governance Committee: [Cross-functional team] • Quarterly policy reviews • Annual comprehensive refresh • Emergency updates as needed 12. EXCEPTIONS Requests for policy exceptions must be submitted to [GOVERNANCE COMMITTEE] with business justification, risk assessment, and proposed compensating controls. 13. RELATED POLICIES • Data Classification Policy • Information Security Policy • Intellectual Property Policy • [Industry-specific]: HIPAA Privacy Policy / PCI DSS Compliance / etc. 14. QUESTIONS Contact [[email protected]] with questions or to report violations. ACKNOWLEDGMENT I have read, understood, and agree to comply with this Generative AI Acceptable Use Policy. Employee Name: ___________________________ Signature: ________________________________ Date: ____________________________________

Customize this template based on your organization’s specific regulatory requirements, risk tolerance, and approved tool list. Consult legal counsel before implementation.

Sector-Specific Addendums

Organizations in regulated industries should add sector-specific provisions:

Healthcare Addendum (HIPAA)

For AI uses involving PHI, first determine the parties’ actual HIPAA roles, the covered functions, and the data flows. Where HIPAA applies, tailor safeguards through the organization’s risk analysis: • Execute a BAA when the vendor is acting as a business associate and between the applicable parties • Select risk-appropriate encryption, integrity, transmission-security, and key-management controls; HIPAA does not mandate AES-256 • Apply access controls and the minimum-necessary standard where applicable • Use purpose-appropriate audit controls and retention; do not assume every raw PHI access log has a universal six-year retention period • Support applicable HIPAA rights to access and amend PHI; HIPAA does not create a general right to delete PHI • Assess and meet the notification duties and timing applicable to the breach, affected individuals, and parties Consumer AI tools should be treated as out of scope for PHI unless the organization has separately verified HIPAA-ready terms and configurations.

Financial Services Addendum (GLBA/FCRA)

For AI systems used in credit, lending, or insurance, identify the organization’s role, the decision activity, and applicable law and policy. Tailored controls may include: • Assess and document fairness risk under applicable fair-lending, anti-discrimination, and organizational requirements • Provide specific principal reasons where adverse-action notice rules apply • Maintain model and system documentation appropriate to the use, validation process, and obligations • Define qualified review, appeal, or override paths according to the activity, automation level, law, policy, and risk; human review is not universally required for every credit decision • Route testing and risk reporting to the appropriate governance body on the cadence required by law or justified by organizational policy and risk; an annual board report is not universal

Applying Glacis

From Policy to Evidence

Policies define what should happen. Scoped operational evidence can make selected claims about what a configured path reported independently checkable. Most organizations have more documentation of intent than inspectable evidence from operation, creating a review gap for regulators and customers.

The Problem with Documentation-Only Governance

Policies, procedures, and self-attestations describe intent. Investigations and customer reviews may also require scoped operational records showing what configured controls reported. Those records add evidence without establishing effectiveness, complete coverage, safety, or compliance on their own.

GLACIS Evidence Infrastructure

GLACIS can preserve signed records of what configured human-review, bias-check, and PII-redaction controls reported for covered events. Third parties can check covered integrity and provenance properties without accessing the full system; whether a review occurred meaningfully or a control worked requires separate evidence.

See the scoped evidence pattern

Frequently Asked Questions

What should a generative AI policy include?

A comprehensive policy should cover: approved tools and platforms, acceptable use guidelines, data classification rules, intellectual property considerations, security requirements, human review requirements, training programs, compliance enforcement procedures, and governance structures with clear ownership and review cycles.

How long does it take to develop an AI policy?

There is no defensible average duration. Timing depends on organizational scope, existing policy, tool inventory, legal and security review, decision rights, training, and approval processes. A template can accelerate drafting but does not replace system-specific review.

What percentage of companies have formal AI policies?

Exact survey figures differ by source, but the broad pattern is consistent: enterprise policy often lags employee adoption of generative AI. That gap creates shadow-AI risk and can expose confidential data or create compliance failures.

Do I need different AI policies for different departments?

One workable structure is an enterprise-wide policy with department-specific addenda. The right structure depends on the organization, use cases, and obligations; legal, customer-service, healthcare, and financial-services teams may need distinct controls and guidance.

How do I enforce an AI policy?

Effective enforcement requires: mandatory training for all employees, technical controls (SSO, DLP integration, monitoring), regular audits of AI usage logs, clear violation categories with progressive discipline, and executive support. Consider appointing AI champions within each department to promote compliance and answer questions.

Should I ban ChatGPT entirely?

Outright bans often backfire by driving usage underground. Instead, approve enterprise versions with proper security controls (ChatGPT Enterprise, Claude for Work, etc.) while prohibiting personal accounts. Provide approved tools that meet employees’ needs. If you don’t, they’ll use shadow AI regardless of policy.

References

Gartner Research. “AI Policy Adoption Survey 2024.” gartner.com
Salesforce. “Global AI Survey: Shadow AI Usage.” 2024. salesforce.com
Bloomberg. “Samsung Bans ChatGPT After Code Leak.” April 2023. bloomberg.com
Mata v. Avianca, Inc., No. 22-cv-1461 (PKC), 2023 WL 4114965 (S.D.N.Y. May 27, 2023). law.justia.com
Deloitte. “Enterprise AI Governance Study.” 2024. Policy development timelines analysis.
NIST AI Risk Management Framework analysis of policy components. nist.gov
U.S. Copyright Office. “Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence.” March 2023. copyright.gov
New York Times Co. v. OpenAI Inc., Case No. 1:23-cv-11195 (S.D.N.Y. Dec. 27, 2023); Getty Images v. Stability AI, Case No. 1:23-cv-00135 (D. Del. Feb. 3, 2023)
Thomson Reuters. “Legal Professional AI Survey 2024.” thomsonreuters.com
U.S. Department of Health & Human Services. “HIPAA Business Associate Agreements.” hhs.gov
Consumer Financial Protection Bureau. “Fair Lending and AI.” consumerfinance.gov
European Commission. “EU AI Act: High-Risk AI Systems.” digital-strategy.ec.europa.eu
NIST. “AI Risk Management Framework (AI RMF 1.0).” January 2023. nist.gov