Does My Company Need an AI Policy?

Yes. If your company deploys, develops, or procures AI systems that affect people in Texas, you need a documented AI policy. Full stop.

Here is why — and exactly what it needs to contain.

Why You Need One (Even Though TRAIGA Doesn't Say “Write a Policy”)

TRAIGA doesn't use the phrase “AI policy.” What it does is codify the NIST AI Risk Management Framework as the only affirmative legal defense against $200,000-per-violation penalties.

The first function of the NIST AI RMF is Govern. Govern requires:

• Documented organizational policies for AI risk management
• Defined roles and accountability structures
• Established processes for AI oversight
• Approved acceptable use boundaries

That is an AI policy. Without one, you cannot demonstrate NIST alignment. Without NIST alignment, you have no affirmative defense. Without an affirmative defense, every AI system you run in Texas is unprotected.

The logic chain is simple: No policy → No NIST alignment → No legal defense → Full exposure to $200K/violation.

The 9 Sections Every AI Policy Needs

1. Scope and Applicability

Define what this policy covers. Which AI systems? Which departments? Which third-party tools? If your marketing team uses ChatGPT and your underwriting team uses a proprietary model, both are in scope.

Key question: Does this policy cover AI embedded in third-party SaaS tools you procure? (It should.)

2. Roles and Accountability

Name the person or team responsible for AI governance. This is not optional — NIST Govern requires explicit accountability. Common structures:

• Small companies (<50 employees): CISO or CLO owns AI risk alongside existing portfolio
• Mid-market: Designated AI Governance Lead reporting to C-suite
• Enterprise: AI Governance Committee with cross-functional representation (legal, IT, compliance, business units)

3. AI System Inventory

Your policy must reference a living inventory of all AI systems in use. For each system, document: purpose, vendor, data inputs, affected populations, risk classification, and the person accountable. Government agencies in Texas must make this inventory public under SB 1964.

4. Acceptable Use Boundaries

Define what AI may and may not be used for within your organization. At minimum, this section must incorporate the 7 TRAIGA prohibited practices:

• No AI designed to incite self-harm, harm to others, or criminal activity
• No AI with sole intent to discriminate against protected classes
• No AI that infringes constitutional rights
• No AI generating child sexual abuse material
• No AI creating non-consensual deepfake intimate imagery
• No government social scoring
• No government biometric ID without informed consent

Then add your organization's own boundaries: approved use cases, data handling restrictions, third-party AI procurement requirements.

5. Risk Assessment Process

Document how your organization evaluates AI risk. This maps to the NIST Map and Measure functions. Include:

• When assessments are triggered (new system, major update, annual review)
• What the assessment evaluates (bias, accuracy, privacy, security, fairness)
• Who conducts the assessment
• How findings are documented and addressed

6. Human Oversight Requirements

Define when a human must review, approve, or override AI outputs. High-stakes decisions (hiring, lending, medical diagnosis, benefits eligibility) should always require human review before action is taken.

7. Incident Response

What happens when AI fails? Your policy needs a defined process for:

• Reporting AI errors, bias incidents, or unexpected outputs
• Escalation paths and response timelines
• Investigation and root cause analysis
• Communication protocols (internal and external)
• TRAIGA 60-day cure window activation procedures

8. Disclosure and Transparency

Document when and how your organization discloses AI use. Even if you're a private company without a mandatory disclosure obligation, proactive transparency strengthens your NIST Govern posture.

9. Review and Update Cadence

An AI policy written in January and never updated is a liability by December. Minimum: annual review. Trigger-based updates for:

• New AI system deployments
• Regulatory changes (new state laws, NIST framework updates)
• AI incidents or near-misses
• Organizational restructuring affecting AI governance roles

Common Mistakes

The Minimum Viable AI Policy

If you're starting from zero and need a defensible AI policy today, cover these three things:

1. Name an owner — One person or team accountable for AI governance
2. List your AI systems — Every AI tool in production, including third-party SaaS
3. Adopt the 7 prohibitions — Copy TRAIGA's prohibited practices into your acceptable use section

That gets you from zero to defensible. Then build out the remaining sections — risk assessment, human oversight, incident response, disclosure — over the next 30 days. Timestamp every version.

A documented AI policy is not bureaucracy. It is the foundation of the only legal defense Texas gives you.