From the buyer's side.

Data governance and permissible use

An AI policy simply defines: may we use this tool, for this job, and who is accountable for it? Does it also answer: may this data be used for this purpose? That gap is significant, because an approved tool can still use data it isn't permitted to use. Picture a member-service assistant your policy approved. The tool is allowed. Now it answers members by reading call notes, loan files and, if someone connected it, the credit report. The tool passed. Did every piece of data it reads pass too?