Is an AI Policy Enough?

Somewhere in your organization there is probably a document that says AI is used responsibly. It may be called an AI policy, an acceptable-use standard or a set of principles, and it was probably approved by someone senior after a meeting that ran long. It promises human oversight, transparency and accountability. The question I want to ask about that document is not whether it is well written. It is whether it could tell you, next Tuesday, what one of your AI systems actually did.

Consider a small case that became a large lesson. In November 2022, a man named Jake Moffatt used the chatbot on Air Canada’s website after his grandmother died, asking about bereavement fares. The chatbot told him he could apply for the reduced fare retroactively. He booked on that basis, and when he applied, Air Canada told him its actual policy did not allow retroactive claims. When the dispute reached British Columbia’s Civil Resolution Tribunal, the airline argued that it could not be held liable for information provided by its chatbot. The tribunal rejected that argument, found that it was reasonable for the customer to rely on the information, and ordered the airline to pay him the difference, about 650 Canadian dollars in damages plus interest and fees (Moffatt v. Air Canada, 2024).

The money was trivial. What matters is the shape of the failure. Air Canada had a policy, and the policy was correct. The system that spoke to customers said something different, and nobody caught the difference until a grieving customer did. The policy described what should happen; it was silent on what was happening. That gap, between a written intention and an operating reality, is where most AI governance quietly lives.

To be fair, the field is getting better at writing things down. Just this month a practitioner-built AI Baseline Control Framework appeared, offering twenty adoptable controls mapped to the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act (van Dijke, 2026). It is genuinely useful and refreshingly short. Its very first control asks that “the organization’s position on AI, including the goals, opportunities and limits for its use, is documented,” and others ask that AI systems are registered, that roles are assigned, and that high-risk uses are logged with human oversight conducted (van Dijke, 2026). If your organization has none of that, start there. A baseline is far better than nothing, and the popularity of short frameworks like this one tells us that teams are hungry for something they can adopt this quarter.

Here is the complication. Most of what a policy or a baseline checklist asks for is documentation: a position is documented, roles are documented, a register exists. Documentation is necessary, but it is evidence that someone wrote something, not evidence that a control operated on a particular decision. Air Canada could presumably have shown you its bereavement policy. What it could not show, at the moment that mattered, was that anything stood between that policy and the words its chatbot produced. The EU AI Act points in the same direction from a legal angle. For high-risk systems it asks deployers not only to have instructions and policies but to “monitor the operation” of the system on the basis of the instructions for use (Regulation (EU) 2024/1689, art. 26(5)). Monitoring operation is a verb about running systems, not about binders.

When I wrote Operational AI Readiness, I tried to put that distinction at the center. The book takes what I still think is the right blunt position: if a system influences consequential decisions, “governance is not a policy document sitting politely upstream from engineering” (Bakos, 2026). It is the discipline built into system design, review, runtime monitoring, change control, escalation and evidence capture. If those things do not exist, the system may still work, “but it is not operationally ready. It is just active” (Bakos, 2026). The test that follows from this is uncomfortable and simple. Pick one AI workflow that touches money, access, employment, customers or security, and ask five questions: what is it allowed to do, what changed last week, who reviews the outputs that matter, what gets recorded, and who can stop it. If the answers live in a policy but not in a record, you have intentions, not controls.

This is FairByDesign analysis rather than settled doctrine, and reasonable people disagree about how much operational evidence a small team can afford to keep. I think the honest answer is that you do not need much, but you need the right things, and you need them before the dispute rather than after it. A chatbot transcript tied to the policy version it should have reflected would have turned the Moffatt case from an argument into a lookup.

Which raises a question most organizations cannot yet answer, and it comes before any question about controls: how many AI systems are actually making or shaping decisions inside your organization right now, and who would know? That is where we go next.

References

Bakos, V. (2026). Operational AI readiness: A practitioner guide to governing AI that is already live. FairByDesign. https://fairbydesign.org/operational-ai-readiness/

Moffatt v. Air Canada, 2024 BCCRT 149. https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.html

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). (2024). Official Journal of the European Union, L, 2024/1689. http://data.europa.eu/eli/reg/2024/1689/oj

van Dijke, J. (2026, October 2). AI Baseline Control Framework (AI BCF) (Version 1.0). https://aibcf.org/controls/

---

FairByDesign is reader-funded. Give once ($5, $10, $25, $50 or any amount), give monthly ($10 or $25), or become a patron.

Give $5 · Give $10 · Give $25 · Give $50 · Any amount · $10 a month · $25 a month · Become a patron

Support never buys editorial control.