What a defensible legal AI governance standard actually contains

An AI policy that states the organisation will use artificial intelligence responsibly is not a control. It is a sentiment. When a regulator, an auditor or opposing counsel asks how a specific output was produced and reviewed, sentiment does not answer the question.

A defensible standard names the model and version used for each approved use case, the evaluation method and accuracy threshold applied before approval, the human review checkpoint and who owns it, the retention period for prompts and outputs, and the escalation path when the model performs outside tolerance.

The organisations that move fastest are not the ones with the loosest policy. They are the ones whose approval path is written down, so a new use case follows a known route instead of negotiating one.