Adoption is already happening

Employees are using generative AI to draft, summarise and code — often through personal accounts. Blocking everything rarely works and pushes usage out of sight. Governance should enable safe use while controlling the real risks.

The main risks

  • Data leakage — confidential or personal data pasted into external tools
  • Inaccurate output — confident but wrong answers used in decisions or customer communication
  • Prompt injection — untrusted content manipulating AI-enabled applications
  • Intellectual property — unclear rights over inputs and outputs
  • Regulatory exposure — personal data processing that conflicts with the DPDP Act

A practical governance model

1. Acceptable use policy

Define approved tools, prohibited data types and required human review. Keep it short enough that people read it.

2. Approved, enterprise-grade tools

Provide sanctioned tools with contractual data protections and no training on your data. Usage moves from shadow to visible.

3. Data protection controls

  • Data classification rules for what may be shared with AI tools
  • Data leakage prevention on browsers and endpoints
  • Logging of usage for sensitive teams

4. Risk assessment for AI use cases

Assess each business use case for impact, data sensitivity and the consequences of wrong output. High-impact uses need human oversight and testing.

5. Secure AI-enabled applications

When you build with AI:

  1. Treat model output as untrusted input
  2. Limit the actions and data an AI agent can reach
  3. Test for prompt injection and data exfiltration
  4. Monitor and log interactions

Where ISO/IEC 42001 fits

ISO/IEC 42001:2023 specifies requirements for an AI management system — policies, roles, risk and impact assessment, lifecycle controls and continual improvement. Organisations with an ISO 27001 ISMS can extend existing governance rather than starting again.

First 90 days

  • Publish an acceptable use policy and approved tool list
  • Inventory current AI usage and use cases
  • Run risk assessments for the top use cases
  • Train staff on safe use and data handling

Key takeaways

  • Enable safe AI use rather than blanket bans.
  • Control data leakage, wrong output and prompt injection.
  • ISO/IEC 42001 extends existing ISO 27001 governance to AI.

Frequently asked questions

Is ISO/IEC 42001 certifiable?

Yes. It specifies requirements for an AI management system, and organisations can be certified by accredited bodies.

Can employees use public AI chatbots?

Only within your acceptable use policy. Most organisations restrict confidential and personal data to approved enterprise tools with contractual protections.

What is prompt injection?

An attack where untrusted content — a web page, email or document — contains instructions that manipulate an AI system into ignoring its rules or leaking data.

Good AI governance says "yes, safely" more often than "no".

Talk to our GRC team about AI governance and ISO/IEC 42001 readiness.