Responsibility will depend on the size and structure of the business. Senior management should approve the policy, while IT, data protection or compliance teams may help create and maintain it.

Employees should be informed about the policy and receive suitable training. The policy should also be reviewed regularly as AI tools, business requirements and security risks continue to change.