An AI policy for a membership organisation

Ask a membership body whether it has an AI policy and the answer is often yes. Ask to read it and you usually find one of two documents. Either a six-thousand-word acceptable-use policy that an insurer provided, in which the words "artificial intelligence" appear twice and neither time helpfully. Or a single-page prohibition list, drafted after an incident, that bans "the use of AI" for anything involving members.

Neither is a policy. The first is a liability document with an AI paragraph bolted on. The second is a rule that will be broken quietly by Thursday, by people who are trying to do their jobs and who have discovered that the ban is impossible to follow.

What a policy is actually for

A policy is not a statement of values, and it is not evidence of compliance on its own. It is a decision procedure — the thing a person consults at the moment they are unsure, in order to act correctly without asking anybody.

That test is brutal and useful. Read the policy and ask: if a policy officer is pasting a paragraph into a chat window at 4:40pm on a Friday, does this document tell them what to do in the next ten seconds? If the answer is "it says to seek guidance from the AI working group", the policy has failed, because nobody seeks guidance at 4:40pm on a Friday.

Everything below follows from that test.

The five decisions, not the twenty principles

A workable policy settles five things. Not twenty. Twenty is how you get a document nobody reads.

• What is approved. The specific tools staff may use for association work, at what tier, on whose account. Naming tools is not endorsing them forever; it is giving people a permitted path so that the unpermitted path is a choice rather than a default.
• What may never be entered. The prohibited categories, in examples a person recognises rather than abstractions. Disciplinary and complaint material, health and disability information, accreditation and examination records, safeguarding material, anything under a legal hold.
• What must be checked by a human. Any output that reaches a member, a regulator or the public. Not "review AI output" — that is unenforceable. "Nothing generated goes to a member without a named person reading it and putting their name to it" is enforceable, because it has an owner and a signature.
• What must be disclosed. When a member is dealing with a machine rather than a person, and when published material was generated rather than written. Both are decisions about what you tell people, and both are cheap to make once and expensive to retrofit.
• Who owns it. A named person, a review date, and a route for a staff member to raise a concern without having to argue with their manager about it.

Five decisions, two pages, one owner. An association that has those is in a materially better position than one with forty pages of principles.

The clauses that change behaviour

Three specific pieces of drafting earn their place. Everything else in a typical policy is either these three in longer words, or decoration.

The ten-second rule. A short list of inputs that may never be entered into any tool, by any route, including a personal phone, expressed as examples. This is the clause that prevents the incident, because it is the only one consulted before the action rather than after.

The named-human rule. Any output that leaves the building carries a person's name. This does two things at once: it satisfies the "human oversight" instinct that Article 26 formalises for high-risk systems, and it removes the diffusion of responsibility that makes AI-assisted errors so easy to produce — nobody feels accountable for a draft they did not write.

The personal-account rule. Association work happens in association accounts. This is the clause that is most often missing from sector policies and most often the actual cause of a problem, because the failure is rarely a staff member deliberately breaching a prohibition. It is somebody using the account already open on their phone because it was faster.

What to leave out

Three things, deliberately.

Do not write a list of approved use cases. It will be out of date before it is signed, and it teaches staff that anything not listed is forbidden — which is how you get shadow AI, the exact behaviour the policy exists to prevent.

Do not attempt to define AI. Every definition in circulation is either too broad to be useful or too technical to be read. Say "any tool that generates, summarises, classifies or decides" and move on.

Do not restate the law. The policy is not a legal briefing. If a staff member needs to know what Article 4 requires, that belongs in the literacy record, not in the document they consult mid-task. One cross-reference is enough.

The relationship to the AI Act, stated honestly

A policy does not discharge any obligation under Regulation (EU) 2024/1689 by existing. It is evidence, and evidence of the wrong thing if it is unread and unowned. What the Act asks for, in practice, is that the association can show named owners, a literacy record, a classification of the systems in use and a written statement of what staff may and may not do. A two-page policy is the fourth of those.

Which means the policy is necessary and not sufficient, and telling a board otherwise would be a small dishonesty that surfaces at the worst moment. If an association adopts the policy and nothing else, it has a document. If it adopts the policy, lists the systems and keeps the literacy record, it has a defensible position — and the difference between those two states is about a week of work, not a programme.

Getting it adopted

The practical obstacle is not drafting. It is that a policy with real prohibitions requires somebody senior to accept that the association will disappoint people. A ban on pasting disciplinary material into a public tool will, on the day it is announced, inconvenience an experienced manager who has been doing it for a year and has strong views about it. If the policy is announced by email with no cover, that manager will conclude the association has become bureaucratic, and the policy will be honoured in appearance only.

Three things make adoption work, and none of them is a communications plan.

1. Say what is now permitted, first. Most staff hear "AI policy" and assume a ban. Lead with the approved tools and the permission, because the permission is what buys the prohibition.
2. Give the prohibited category somewhere to go. A rule that says "never" without an alternative is a rule that will be broken. If disciplinary material cannot go into a public tool, staff need to know what they should do instead — even if the answer is "nothing, this one stays manual for now".
3. Publish the review date. A policy with a date on it is a policy somebody intends to maintain. One without reads as a document written to be filed.

Two pages, five decisions, three clauses, one named owner, one review date. That is the whole artefact — and it is the cheapest thing on the association's AI list, which is why there is no good reason for it to be the thing that is missing.

---

The full picture: The AI Act for associations — what your body must actually do covers provider versus deployer, the four duties, the dates, and the five items of evidence a board will ask for.

Before the policy: AI Act Article 4 — the evidence that actually satisfies it is the literacy record the policy sits on top of.

If drafting this is the job that keeps moving down the list, First Build is ten working days on one deferred job — the policy, the inventory or the literacy record — delivered rather than discussed.