The Autonomy Standard
Replace a blanket AI policy with a one-page tiered standard. Tier 1: low stakes, no sensitive data, use freely. Tier 2: reaches a client, colleague or record, so a defined human review happens before it leaves your hands. Tier 3: regulated or confidential, documented approval before AI is used at all.
Use when an organisation has a vague AI policy and shadow use has quietly begun.
Solves: Shadow AI use is worse than considered use, because it cannot be audited, learned from, or improved.
- 1
Step 1: Name one process that produces work for external eyes or for the record. Write what it produces (10 min).
- 2
Step 2: Read the current policy aloud. Ask the operators what they actually do. Note the gap (10 min).
- 3
Step 3: In three groups, draft the kinds of work in this process belonging to each tier, with real examples (25 min).
- 4
Step 4: For Tier 2, name who reviews. For Tier 3, name who signs off. A tier with no name is not a tier (15 min).
- 5
Step 5: Assign a single owner who updates the standard quarterly. Agree the date (5 min).
- The people who sign the tiers must be the ones who will defend them if something goes wrong. Get them in the room.
- If the draft runs past one page, or uses compliance language, no operator will use it. Cut it.
- Do not let Legal or IT write this alone. Operators present, in one room, in one day.