The gap is categorical. An AI acceptable use policy is an instruction to people. A control is a property of the system. An organization can have an excellent AI policy, trained staff, and a signed acceptable-use form, and still have nothing that stops a customer's account number from being pasted into a consumer chatbot at 4 p.m. on a Friday.
Most organizations get this wrong in good faith. They have done real work, and that work is documentation. Writing the policy is the part that feels like governance. Enforcement needs a place in the architecture where a rule can actually be applied, and most deployments never established one. The guide to stopping customer data reaching ChatGPT from a Windows PC shows the policy, settings, workspace, and gateway layers together.
How to ask it
- A good answer
- A demonstration. Here is a rule; here is the system refusing, escalating, or alerting when the rule is triggered, live.
- An evasion
- "We have a comprehensive AI policy." "All staff are trained on acceptable use." Both may be true, and neither is a control.
- The follow-up
- Show me it being enforced.
Why it fails more often than the other four combined
A rule can only be enforced at a point the request passes through. If each application talks to its own AI model directly, each one needs its own copy of every rule, and the copies drift. If every request passes one control point, a rule is written once and applies everywhere, including to tools adopted after the rule was written. Read operationalizing AI governance in 2026 for how enterprises put governance rules into production workflows.
What to check this week
- Pick one rule from your AI policy, for example "no customer personal data in prompts."
- Find the point in the system where that rule is checked before a request leaves. If there is none, the rule is written down.
- Try to break it, with permission, and see what happens. A control acts on the request (blocks, replaces or routes it) and leaves a record.
How the scorecard scores
- 0, no evidence. Nobody can produce a record, a name, or a sample.
- 1, on paper or partly. A document, an owner, or a partial sample exists.
- 2, operating. The control runs on a defined cadence and produces dated evidence.
For a five-minute evidence test, ask for the last risk review, the last blocked or escalated event, the last human override, the last incident or false-positive review, and the ticket showing that the fix closed. The score is a diagnostic and proves no conformity with ISO/IEC 42001 or any other framework.
Frequently asked questions
- What is the difference between an AI policy and an AI control?
- A policy is an instruction to people. A control is a property of the system. A policy document says what people are supposed to do, while an operating control produces evidence that it prevents, detects, escalates, constrains, or corrects risky behavior. An organization can have an excellent policy and still have nothing that stops a customer's account number from being pasted into a consumer chatbot.
- How do you test whether an AI control is enforced?
- Pick one rule from your AI policy, such as no customer personal data in prompts. Find the point in the system where it is checked before a request leaves. If there is none, the rule is written down. Then try to break it, with permission, and see what happens. A control acts on the request and leaves a record.
- Why do AI controls fail to get enforced?
- A rule can only be enforced at a point the request passes through. If each application talks to its own AI model directly, each one needs its own copy of every rule, and the copies drift. If every request passes one control point, a rule is written once and applies everywhere, including to tools adopted after the rule was written.
- How does the evidence scorecard score a control?
- Each control scores 0, 1, or 2. Zero means no evidence: nobody can produce a record, a name, or a sample. One means on paper or partly: a document, an owner, or a partial sample exists. Two means operating: the control runs on a defined cadence and produces dated evidence. The score proves no conformity with ISO/IEC 42001 or any other framework.