AI policy exception management

What it does

It keeps departures from policy visible and temporary. Where a requirement cannot be met, the owner requests an exception, states the risk and the compensating measures, and a named authority accepts or refuses it for a fixed period. The governance function operates the register; the level of approval rises with the risk. It applies whenever a requirement is not met, before approval or in operation.

How to implement it

• Require a written request stating the requirement, the reason, the risk and the compensating measures.
• Set who may accept which exceptions, by tier and by type.
• Give every exception an expiry date and a plan to close it.
• Record exceptions in one register.
• Report open, overdue and repeated exceptions to the governance forum.
• Treat an expired exception as a breach until it is renewed or closed.

Evidence it operates

Design: an exception procedure with approval authorities. Operation: a register showing requester, approver, expiry and status; examples of exceptions refused; evidence of closure or renewal at expiry; reporting of the totals to the forum.

Where it fits

Works alongside the policy at approval and in operation. It supports no documented AI policy by handling departures in a controlled way, and shadow AI use by giving a legitimate, time-limited route to use a tool not yet approved. Its totals feed AI risk reporting to the board.

Limits

Exceptions that are renewed indefinitely have become the policy, and the policy should be changed or the practice stopped. Accepting a risk does not reduce it. If exceptions are easy to obtain the requirement has no force; if they are impossible, people stop asking and simply do not comply. Some requirements, such as legal prohibitions, cannot be waived at all.