Incidents, honest measurement, and keeping the policy alive

When AI gets something wrong

Something will eventually go wrong: a wrong figure reaches a client, personal data goes into the wrong tool, an AI-drafted message causes offence. Handle it like any other operational incident, with a known route and no drama.

• Contain first: correct the output, notify affected parties where needed, and stop the same use until it's understood.
• Remember data protection duties: if personal data went somewhere it shouldn't, assess it as a potential personal data breach. UK GDPR's reporting clock, 72 hours to notify the ICO where the breach is reportable, doesn't pause because AI was involved.
• Learn without blame theatre. If the person followed the policy and the policy allowed the failure, fix the policy. Punishing honest reports teaches people to stop reporting, which is how small incidents become large ones.

Measure value honestly

AI use should justify itself with the same honesty you'd apply to any other spend. Count the whole cost: licences, review time, training, and rework. Compare against outcomes you can actually observe, such as turnaround times, output quality, and where staff time went, rather than enthusiasm. Be willing to conclude that a use case isn't paying for itself; retiring a mediocre use case frees attention for the ones that genuinely work, and it builds credibility for the programme as a whole.

Review the policy on a schedule

Your AI policy is a living document in a fast-moving field. Put a review date on it, at least annually and sooner if the tool list, the law, or your services change materially. At each review: check the approved tool list against reality, reread the incident and monitoring record, revisit the regulatory position since the landscape at the time of writing will not be the landscape a year on, and prune anything nobody follows. A short policy that matches reality is worth more than an impressive one that doesn't.