Following Organizational AI Governance Policy
Audience: professionals who use Claude at work, no coding or API knowledge needed. Verified = checked against Anthropic's documentation or help center on 2026-10-16. General background = standard regulatory or industry knowledge, not an Anthropic statement. Design guidance = widely taught practice.
Organisations differ, so this note teaches the skill of applying a policy, not a specific policy. The routine is design guidance; the anchors below are verified.
Where policies come from (verified)
- NIST AI RMF 1.0 organises AI risk work into four functions, Govern, Map, Measure, Manage; Govern is cross-cutting and calls for policies that are in place, transparent and implemented.
- ISO/IEC 42001 is the certifiable international standard for an AI management system: leadership, planning, support, operation, performance evaluation and continual improvement.
- Anthropic Usage Policy sets the floor every organisation's policy sits on: human review and disclosure for high-risk uses, AI disclosure for consumer chatbots.
- Claude Team and Enterprise controls: an Owner must enable a connector under Organization settings before members can use it; Enterprise role-based permissions can set each connector or tool to always allow, needs approval or blocked, and the organisation-wide setting is a ceiling roles cannot widen.
What AI governance policies usually cover
| Area | Typical rules |
|---|---|
| Approved tools and accounts | Which AI tools and which accounts (organisation-provided, not personal) may be used |
| Data rules | What data classes may be entered; anonymisation and retention requirements (D6.1) |
| Permitted and prohibited uses | Appropriate and inappropriate use cases (D6.3) |
| Human oversight | What must be reviewed and by whom (D2.1) |
| Disclosure | When to tell customers or colleagues AI was involved |
| Connectors and integrations | Which connectors, plugins and skills are allowed; who approves new ones (D5.3) |
| Quality and records | Keeping prompts, outputs and approvals for important work |
| Incidents | How to report a mistake, leak or misuse |
| Training and ownership | Required training; who owns AI governance |
A practical routine for any AI task
- Is this use case permitted? If the policy is silent, ask the owner; do not assume yes.
- Is the tool and account approved?
- Is the data allowed here? Minimise and remove identifiers.
- What review is required? Plan it before you start.
- Do I need to disclose AI involvement?
- Record what policy requires (inputs, approvals).
- If something goes wrong, report it promptly under the incident process; do not quietly fix and move on.
Worked scenarios
| Scenario | Policy-minded answer |
|---|---|
| You want to paste a customer complaint with the customer's name and account number into Claude to draft a reply | Check whether customer data is allowed in the approved tool; if so, remove the account number and keep only what is needed; a person reviews and sends the reply |
| A colleague asks you to connect a community connector to read the company email | Not without approval: connectors add access; follow the approval process and the connector review rules (D5.3) |
| You used Claude for a client figure and later found it wrong | Correct it, tell the client if needed, and report it through the incident process so others learn |
| A manager wants AI to rank job candidates | That is a consequential decision about people; check policy and involve HR and legal; a human must decide |
When the policy is unclear
Ask the AI governance owner, your manager or compliance. Choose the more cautious option until you hear back. Suggest improvements to the policy so the gap is fixed for everyone.
Exam traps
- Assuming "not prohibited" means permitted.
- Using personal accounts because the approved tool is inconvenient.
- Hiding a mistake to avoid trouble.
- Applying the policy once and forgetting that it changes.
- Adding connectors on your own.
References
- NIST AI RMF 1.0 (AI 100-1) — checked Oct 16, 2026
- ISO/IEC 42001 — checked Oct 16, 2026
- Anthropic Usage Policy — checked Oct 16, 2026
- Role-based permissions on Enterprise plans — checked Oct 16, 2026
- Microsoft 365 connector security guide (Owner enablement) — checked Oct 16, 2026
Check your understanding
The policy does not mention your use case. What do you do?Show answerHide answer
Answer
Ask the policy owner or compliance and take the cautious route meanwhile.You find an AI-assisted error in sent work. Next step?Show answerHide answer
Answer
Correct it and report it under the incident process.Who approves new connectors in many organisations?Show answerHide answer
Answer
The organisation's Owner or admin, following the policy.