How to define an AI guideline for a company

What is How to define an AI guideline for a company?

An AI guideline must turn an intended use into a verifiable boundary: what object enters, what outcome is expected, who may act, which decision remains human, and what evidence must remain. NIST's AI RMF is intended for voluntary use and seeks to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI systems; use it as a structural reference, not as automatic permission for an application.

Start with one scope sentence: “in this workflow, AI may support X, using Y as its source, under Z's review.” In fashion, X might be organising fit comments, comparing versions of a tech pack, suggesting fields for a product record, or locating discrepancies between a sample and a specification. Do not make “use AI” the objective. Also record what is out of scope, which data may not enter, and which event stops the workflow.

How should risk, responsibility, and evidence be mapped?

The AI RMF Core organises risk management into govern, map, measure, and manage. NIST also advises that risk management should be continuous, timely, and performed throughout the AI system lifecycle, with diverse and multidisciplinary perspectives that may include actors outside the organisation. This supports a guideline that returns to design when data, supplier, model, channel, or purpose changes.

Apply the map to each stage of product development: input, transformation, output, owner, permission, and acceptance criterion. For a material suggestion, request the source and version consulted; for a sample classification, name the confirmer; for a supplier message, preserve review before sending. The minimum record should allow the decision to be reconstructed without relying on one person's memory.

The European Commission describes risk-based rules for AI developers and deployers regarding specific uses, with four levels: unacceptable, high, limited, and minimal or no risk. It also says that AI systems considered a clear threat to people's safety, livelihoods, and rights are banned by the AI Act. Treat these levels as a triage question, not as universal legal classification: territorial scope, the specific use, and applicable interpretation must be assessed separately.

How should the guideline fit a fashion value chain?

Adaptation to fashion starts with the object that moves through the process. In an AI production pilot, separate brief, design, material, supplier, sample, order, and channel; do not treat them as one data object. Define the source of truth, update frequency, approving person, and correction method for an invalid version. The guideline should say when a recommendation returns to agent governance, when escalation is required, and when execution is not allowed.

For personal data or decisions that affect people, include a data-protection check. The ICO offers guidance suitable for public, private, and third-sector businesses, a detailed overview of applying UK GDPR principles to information used in AI systems, and a practical risk-assessment aid for considering effects on individual rights and freedoms. These references do not replace analysis of the law applicable to a case, but they help turn “privacy” into questions about purpose, access, retention, explanation, and challenge.

Close the guideline with a short test: is the use case described? Is authority named? Is the source traceable? Does the output have an acceptance criterion? Is there a route for error, challenge, and interruption? Record version, date, owner, result, and exception. Measure what the team actually needs to observe — rework, data failures, waiting time, or review quality — without claiming improvement before comparing the same scope. Link the document to company AI context and team AI adoption so the rule follows the work rather than only the tool.