Skip to content

Responsible AI resourceMenuHomeModel policyDecisionsResearch & approachGet support

Leadership guide/Operations & assurance

Operations & assurance

Make the policy
work in practice.

Turn policy into arrangements people can follow. These HumanSkills recommendations help institutional owners decide whether a use may begin, what evidence is needed and how it will remain accountable. Adapt the controls to the actual use and existing institutional authority.

Download the guide↓Editable working records→

Risk and approval

What exactly are we authorizing?

A scoped approval with conditions, an owner and a review date.

Open the guide →AI security controls

Can the boundaries hold when the system behaves unexpectedly?

A verified control record for the approved environment.

Open the guide →Vendor evidence and commitments

What can the supplier demonstrate and commit to?

A documented supplier review tied to the actual product and contract.

Open the guide →Testing and release

What evidence justifies a live pilot or wider use?

A release decision supported by results and known limitations.

Open the guide →Monitoring and incident response

Who notices a problem and who can act?

A working monitoring and response plan with accountable restart authority.

Open the guide →

Keep one
accountable record.

Use these guides with the model policy and your existing procedures. The goal is a clear decision and evidence that the arrangements work.

Before use

Describe the purpose, classify the risk, review the supplier and test the controls.

At release

Record the scope, conditions, approver, evidence and reasons for the decision.

During operation

Monitor meaningful outcomes, handle incidents and revisit material changes.

Use this with your team→Read the model policy→

The basis for these guides.

HumanSkills implementation recommendations informed by the sources below. These voluntary resources are not legal requirements or a certification. Apply current institutional requirements and specialist review to the actual use.

• NIST AI Risk Management Framework Generative AI Profile ↗Voluntary risk guidance informing evaluation, third-party management and ongoing review.
• OWASP Prompt Injection ↗Technical guidance informing tests of untrusted content and permission boundaries.
• OWASP Excessive Agency ↗Technical guidance informing limits on connected tools, permissions and autonomous actions.
• NIST Cybersecurity Framework 2.0 ↗Outcome-based guidance for connecting AI services to institutional cybersecurity controls; it does not prescribe a universal implementation.
• OWASP Improper Output Handling ↗Guidance on validating model outputs, safe database operations and context-appropriate output encoding.
• OWASP Data and Model Poisoning ↗Guidance on provenance, controlled changes and malicious content affecting data and model components.
• EDUCAUSE HECVAT guidance ↗Higher-education vendor assessment, including privacy and AI questions. Evaluate responses and product-specific evidence through the existing institutional process.

Support for your
AI task force.

Work with HumanSkills on AI policy, governance and the decisions your institution needs to make.

Talk about task force support→