Summary: Writing an AI policy is the easy part. Examiners, allocators and boards now ask a harder question: can you show the policy is followed? Compliance teams already run programs that answer that question for personal trading and electronic communications. AI governance needs the same four parts: a policy, pre-approval, an inventory, and testing.
The gap
Over the past year, most of the investment managers we talk to have written an AI acceptable use policy. Usually it lists approved tools, prohibits putting client or investor data into anything unapproved, and asks employees to request new tools through IT or compliance.
The compliance consultants we work with describe the same pattern across their clients. The policy exists, but nothing behind it shows whether it is working. Nobody can say which AI tools are in use this month, how many requests came in, how long they took, or whether anyone is going around the process.
That gap matters because the people asking about AI have moved past "do you have a policy?" The SEC's FY2026 examination priorities say examiners will assess whether firms have adequate policies and procedures to monitor and supervise AI use. Allocators ask for the list of approved tools and how new ones get approved. A 2025 Gartner survey of cybersecurity leaders found 69% of organizations suspected or had confirmed employees using prohibited AI tools. A policy alone doesn't tell you which group you're in.
You've solved this problem before
Compliance teams at investment firms already run two programs with the same shape.
Personal trading. No firm stops at a code of ethics. There is pre-clearance before a trade, holdings and transaction reports after, and periodic testing that compares the two. The policy sets the rule, and the rest of the program produces evidence that people follow it.
Electronic communications. Firms don't rely on an "approved channels only" memo. They archive approved channels, surveil them, and test for off-channel use. The SEC's off-channel communications cases showed that a policy without recordkeeping and monitoring behind it does not protect a firm.
AI governance is heading the same way. One of our advisory partners put it simply: AI oversight is becoming a compliance responsibility in the same category as e-comms and personal trading, with the same expectation of evidence.
The four parts
| Part | Personal trading equivalent | What it looks like for AI |
|---|---|---|
| Policy | Code of ethics | Approved tools, permitted data, prohibited uses, who owns decisions |
| Pre-approval | Pre-clearance | A request process that captures the tool, the purpose and the data, and returns a decision in hours |
| Inventory | Holdings reports | A continuously updated list of AI in use, built from systems data rather than self-reporting |
| Testing | Periodic surveillance review | Comparing what's in use against what was approved, and recording what happened to every exception |
Most firms have the first part. Some have an email-based version of the second. Very few have the third and fourth, and those are the parts that turn a policy into evidence.
Two failure modes
The policy is too slow. If a new tool takes three weeks to approve, people stop asking. The approval queue looks quiet and the policy looks like it's working, while the actual usage happens elsewhere. Speed of approval is a control, because it determines how much activity flows through the process at all.
The inventory depends on memory. An annual attestation where employees list the AI tools they use captures only what they remember and are comfortable declaring. It misses AI features vendors switched on inside approved software, which is now where much of the exposure sits.
Who owns it
In our conversations, the firms that make progress have a working relationship between compliance and IT, with a clear owner for AI decisions. Compliance sets the rules and makes judgment calls. IT supplies the systems data and the technical review. When neither group owns AI adoption, requests stall and the inventory never gets built.
Where Clarier fits
Clarier gives that program a system. It builds the inventory from your identity, endpoint, network and data protection tools, routes requests through templated intake, records each decision with the purpose and data it was approved for, and flags anything in use that was never approved. The result is the evidence trail your policy assumes already exists. See how this works for governing the AI estate.
To see which of the four parts your firm already has, take the AI program maturity assessment.
