← AI Safety, Alignment & Ethics

⏱ About 20 min✦ 20 XP

Draft an AI Policy

Every governance framework you have studied in this module — the EU AI Act, the NIST AI Risk Management Framework, the Bletchley Declaration, national regulations on algorithmic accountability — began as a draft. Someone had to sit down, identify the problem, define the key terms, decide who is regulated and what they must do, and write it out precisely enough to be enforceable. That process is the work of governance, and it is work you can do right now.

In this lesson, your task is to draft a real, specific, complete AI governance policy proposal. Not a summary of policies that already exist. Not a reflection on what good AI governance looks like in the abstract. A policy — a document specifying what is required, of whom, verified how, enforced by what mechanism, with what consequences for non-compliance — for a specific AI application in a specific context. This is harder than it sounds. Vague language is the enemy of enforceable policy. 'AI systems should be fair' is not a policy; it is an aspiration. 'An AI system used in employment screening must produce disparate impact ratios within 0.8 to 1.25 of the group with the highest selection rate across all groups defined by race, gender, and age category, verified by an independent auditor using methodology compliant with NIST SP 1270, before first deployment and annually thereafter' — that is policy language. Notice the difference: specific metric, specific covered demographic categories, specific verification methodology, specific timing. You will work through a structured drafting process that breaks the policy into its essential components. By the end, you will have a document that could, in principle, be submitted to a real policy process.

What Makes Policy Language Fail

Policy fails at three points: vagueness (the requirement is too undefined to measure compliance), loopholes (the scope definition excludes the cases that matter most), and unenforceability (the agency lacks the technical expertise, resources, or legal authority to verify compliance). Good drafters stress-test their own language against all three failure modes before submitting.

Draft Your AI Governance Policy

  1. You will draft a complete AI governance policy proposal. Work individually or in pairs. Your final product is a document of 600-1000 words covering all seven sections below.
  2. STEP 1 — CHOOSE YOUR PROBLEM DOMAIN
  3. Select one of the following AI application areas, or propose your own with instructor approval:
  4. (A) AI systems used by public schools to flag students at risk of dropping out or requiring disciplinary intervention
  5. (B) AI-generated content in political advertising and campaign communications
  6. (C) AI systems used by landlords or property management companies to screen rental applications
  7. (D) AI used by healthcare insurance companies to determine coverage eligibility or prior authorization for medical procedures
  8. (E) Facial-recognition systems used by retailers for loss prevention
  9. STEP 2 — DEFINE THE SCOPE (write this section)
  10. Precisely define what systems and actors your policy covers. Answer: What type of AI system? What specific use case? Who is the regulated party (developer, deployer, or both)? What minimum threshold (by size, revenue, deployment scale, or risk level) triggers the requirements? Be specific enough that a court could determine whether a given system is covered.
  11. STEP 3 — STATE THE OBLIGATIONS (write this section)
  12. Specify exactly what regulated parties must do. For each obligation: Is it a prohibition (you may not do X), a requirement (you must do Y before Z), a disclosure (you must inform W of V), or an enabling right (affected parties must be able to do Q)? Write each obligation as a numbered requirement. Aim for 4-6 obligations.
  13. STEP 4 — DEFINE THE RIGHTS OF AFFECTED INDIVIDUALS (write this section)
  14. Who are the people most affected by this AI system? What rights do they have under your policy? At minimum consider: the right to know the AI system was used; the right to a meaningful explanation of the basis for decisions; the right to contest decisions before a human reviewer; and the right to seek redress if harmed.
  15. STEP 5 — SPECIFY ENFORCEMENT (write this section)
  16. Which agency or body is responsible for enforcement? What authority does it have — inspections, fines, suspension of operation, mandatory remediation? What is the penalty schedule? Who can bring a complaint? What is the timeline for complaint resolution?
  17. STEP 6 — ADDRESS LIMITATIONS OF YOUR POLICY (write this section)
  18. Every policy has gaps. Identify at least two honest limitations of your draft: something it does not cover that arguably it should, a way a regulated party could comply technically while violating the spirit, or a provision that may be technically infeasible to verify.
  19. STEP 7 — APPLY THE ETHICS TEST
  20. For each of the four frameworks from Lesson 7, write one sentence evaluating your policy: (A) Consequentialist: does it produce better outcomes on net? (B) Deontological: does it protect relevant rights? (C) Virtue ethical: would a wise and just policymaker stand behind this? (D) Contractualist: could affected parties reasonably accept its terms?
  21. DELIVERY AND CRITIQUE
  22. Share your policy with another pair. Their job is to find the loophole — one specific way a regulated party could comply with every letter of your policy while still causing the harm you intended to prevent. Then swap and find their loophole. Revise your policy to address the identified loophole.
  23. Final step: In one paragraph, reflect on what this exercise taught you about the difficulty of governance that you did not fully appreciate before.
Real Policy Resources

You can read real policy language as models. The EU AI Act's Recital 14 (defining AI systems) and Articles 6-9 (on high-risk systems) are publicly available at EUR-Lex. The EEOC's 2023 technical assistance on AI and Title VII is available on eeoc.gov. The CFPB's blog post on AI in credit decisions is on cfpb.gov. Reading how actual regulatory language handles definition and scope will make your own drafting more precise.

A policy requires that 'AI hiring tools must be fair to all groups.' A company uses an AI tool that gives Black applicants lower scores at twice the rate of white applicants. The company argues they are not in violation because 'fair' is undefined in the policy. What drafting failure does this illustrate?

A student drafts an AI policy that requires AI hiring systems to be audited annually by an independent third party. Another student points out that the policy does not define what qualifies as an 'independent third party' or what the audit must examine. Which failure mode does this gap create?

← Back to AI Safety, Alignment & Ethics