Decide and assign
A policy kept in a loose document leaves no record of which version applies or who has read it.
Alethexis turns your AI use policy into a document with a lifecycle: it starts from a template for your sector, is edited section by section, goes through review, has its approval recorded and is published by the Owner. Each publication is a new version, and earlier ones are kept.
Your internal policy ready to publish, covering BYOAI and shadow AI. Generated as a PDF to circulate; the acknowledgement panel records who has confirmed reading it.
The policy is an internal methodological control: it sets out your internal rules on the use of AI and keeps a record of how it was circulated. It does not replace legal advice.
The platform creates the first version with starting text for your sector. Everything is editable: scope and definitions, acceptable and prohibited uses, BYOAI rules, shadow AI prevention, human oversight, incident procedure, training and review schedule.
While you edit, you can download a draft PDF with a “BORRADOR” (draft) watermark to review internally. The policy cannot be published with empty sections: each one needs minimum content.
The policy moves from draft to review, from review to approval recorded, and then to published. The Owner or the AI Officer records the approval; only the Owner publishes. Each step is kept in the approval history with the person, their role and the date.
On publication the final PDF is generated, the platform records the SHA-256 integrity hash of the file as it is downloaded and adds it to the organisation's evidence. Whoever publishes ticks the section's closing statement.
Each member acknowledges the current version from the section itself, and the block shows how many have done so, for example “4 of 6 members have acknowledged it”. A new version is acknowledged afresh; earlier acknowledgements are kept.
Policy PDF with a SHA-256 hash
An A4 document with a cover page, table of contents, the policy sections and the approval history recorded up to the moment it was generated. Annex A lists the active AI systems in the inventory (VIS-1) and Annex B those classified as P5 or P6 in VIS-2, levels of Alethexis's internal taxonomy, not the AI Act's nomenclature.
Acknowledgement record
How many members have acknowledged the current version, and the date of each acknowledgement, in the platform.
The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.
Publish a first (Foundation) version of the acceptable use policy for AI: which tools are permitted, internal prohibitions, data that must not be entered into external GPAI systems, and the incident channel. It is the basis on which Module 2 will build the full governance framework.
Legal basis
No direct basis in law.
Inform the whole workforce that the programme exists, who the AI Officer is (if one has been appointed), which policies are current and where the incident channel is. A programme the workforce does not know about is unlikely to be applied.
Legal basis
No direct basis in law.
Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.