Your company’s AI policy is probably outdated.贵公司的人工智能政策可能已经过时了。
Until recently, a company’s AI policy was essentially an “acceptable AI use” document, containing items such as “do not paste confidential information or private data into public chatbots,” “check AI-generated outputs before using them,” and “do not use a new tool before asking the legal department.”直到最近，公司的人工智能政策本质上还是一份“人工智能可接受使用”文档，其中包含诸如“不要将机密信息或私人数据粘贴到公共聊天机器人中”、“使用人工智能生成的输出前请先进行检查”以及“在使用新工具前请先咨询法律部门”等条款。
It is now September 2026, and that is no longer enough.现在是 2026 年 9 月，这些已经不够了。
The AI ecosystem, along with the AI policy and regulatory environment, has changed.人工智能生态系统，连同人工智能政策和监管环境，都已经发生了变化。
AI is now an operational layer, fully embedded in the corporate environment and the company’s core business, and companies deploy AI, AI agents, and multi-agent systems on a daily basis.人工智能现在是一个运营层，已完全嵌入到企业环境和公司的核心业务中，公司每天都在部署人工智能、人工智能体（AI agents）和多智能体系统。
At the same time, AI regulation has evolved, and companies must comply with new, enforceable legal requirements, as well as an ongoing flow of global standards and frameworks that have become mainstream and a core part of the AI governance stack.与此同时，人工智能监管也在不断演进，公司不仅必须遵守新的、可执行的法律要求，还要应对源源不断的全球标准和框架，这些标准和框架已成为主流，并成为人工智能治理体系的核心组成部分。
Today, an effective AI policy must achieve at least these three goals:今天，一份有效的人工智能政策必须至少实现以下三个目标：
Establish the company’s approach to responsible AI adoption and how to implement it确立公司对负责任人工智能采用的态度及其实施方式
Create a high-level system of risk governance and compliance controls建立一套高水平的风险治理和合规控制体系
Protect the organization from rapidly evolving AI security threats保护组织免受快速演变的人工智能安全威胁
An AI policy is a living document that must respond to organizational changes, compliance requirements, and technological developments.人工智能政策是一份动态文档，必须能够响应组织变革、合规要求和技术发展。
It’s a joint effort between legal, technical, and operational teams and, in my opinion, an excellent AI governance exercise for the whole organization.这是法律、技术和运营团队共同努力的结果，在我看来，这也是整个组织进行人工智能治理的一次绝佳实践。
(As I have written before, the AI governance career is diverse, which is why in every cohort of my AI Governance Leadership Program there are leaders from various disciplines and industries.)（正如我之前所写，人工智能治理职业具有多样性，这就是为什么我的“人工智能治理领导力项目”每一期都有来自不同学科和行业的领导者参加的原因。）
With that in mind, I prepared a full guide with essential information for companies drafting or updating their AI policy in late 2026, covering the following topics:考虑到这一点，我准备了一份完整的指南，为 2026 年末起草或更新人工智能政策的公司提供必要信息，涵盖以下主题：
Regulatory concerns监管关注事项
AI inventory人工智能清单
Risk tiers and controls风险层级与控制
Human oversight and accountability人工监督与问责
AI incident response人工智能事件响应
Logging日志记录
Agentic AI智能体人工智能（Agentic AI）
Training培训
Updating更新
Items to be covered需涵盖的项目
Let's get started:让我们开始吧：
1. Review the latest regulatory developments1. 审查最新的监管动态
One of the most important developments for multinational businesses in 2026 is that, as the AI Act has entered its enforcement phase, there are more obligations to comply with, even for companies based outside Europe.对于 2026 年的跨国企业来说，最重要的发展之一是，随着《人工智能法案》（AI Act）进入执行阶段，即便对于总部位于欧洲以外的公司，也存在更多的合规义务。
Even though the Digital Omnibus on AI postponed high-risk obligations to 2027 and 2028, various requirements are already fully enforceable, including:尽管《人工智能数字综合法案》（Digital Omnibus on AI）将高风险义务推迟到了 2027 年和 2028 年，但多项要求已经完全具备可执行性，包括：
AI practices listed in Article 5, which have been prohibited since February 2025第 5 条所列的人工智能实践，自 2025 年 2 月起已被禁止
Obligations for providers of general-purpose AI models, which began applying in August 2025通用人工智能模型提供商的义务，自 2025 年 8 月开始适用
Transparency requirements, which began applying on August 2, 2026透明度要求，自 2026 年 8 月 2 日开始适用
Transparency requirements are now particularly important. They include letting people know when they are interacting directly with AI systems, watermarking, and disclosure requirements for deepfakes and AI-generated content, and letting people know when they are exposed to emotion recognition systems or biometric categorization systems. I wrote more about these obligations here.透明度要求现在尤为重要。它们包括：当人们直接与人工智能系统交互时告知用户；添加水印；对深度伪造（deepfakes）和人工智能生成内容进行披露；以及当人们接触到情感识别系统或生物识别分类系统时告知用户。我在这里更详细地写过关于这些义务的内容。
A major change in 2026 is that organizations can no longer treat transparency as an abstract ethical principle. In many jurisdictions, transparency is now a legally enforceable requirement, including for companies worldwide that are covered by the EU AI Act, and non-compliance can lead to fines.2026 年的一个重大变化是，组织不能再将透明度仅仅视为一种抽象的道德原则。在许多司法管辖区，透明度现在是一项具有法律约束力的要求，包括对于全球范围内受欧盟《人工智能法案》管辖的公司而言，不合规可能导致罚款。
In the United States, there is no comprehensive federal AI law; however, states have been proactively and prolifically regulating AI over the past few years, and various state laws have specific compliance requirements for providers and deployers of AI systems.在美国，虽然没有全面的联邦人工智能法律，但各州在过去几年中一直积极且高产地监管人工智能，各种州法律对人工智能系统的提供商和部署者都有具体的合规要求。
On this topic, I recommend watching my recent class on how California is transforming AI regulation.关于这个主题，我建议观看我最近关于加州如何变革人工智能监管的课程。
These legal requirements, and any additional laws the company has to comply with, should be reflected in the AI policy and incorporated into company-wide controls and governance mechanisms to avoid legal, ethical, and safety risks.这些法律要求以及公司必须遵守的任何其他法律，都应反映在人工智能政策中，并纳入全公司的控制和治理机制，以规避法律、道德和安全风险。
2. Start with an AI inventory2. 从人工智能清单开始
Many companies write their AI policy as a separate document, disconnected from business operations, and include general “responsible AI principles” (similar to how many companies drafted their privacy policies in the early 2010s).许多公司将人工智能政策写成一份独立的文件，与业务运营脱节，并包含通用的“负责任人工智能原则”（类似于 2010 年代初许多公司起草隐私政策的方式）。
The AI policy should be a high-level AI governance document for the whole organization, and a reasonable place to start is by identifying what, when, and how the company already uses AI.人工智能政策应当是一份针对整个组织的高层人工智能治理文档，而一个合理的切入点是识别公司已经在使用什么、何时使用以及如何使用人工智能。
That sounds simple, but many businesses (a large part of them, I would guess, given how prevalent the problem of “shadow AI” is today) cannot answer basic questions such as:这听起来很简单，但许多企业（考虑到当今“影子人工智能”问题的普遍性，我猜测其中很大一部分）无法回答一些基本问题，例如：
Which AI systems are employees using? When and how do they use it?员工正在使用哪些人工智能系统？他们何时以及如何使用？
Which vendors, partners, and suppliers process company information using AI?哪些供应商、合作伙伴和供货商正在使用人工智能处理公司信息？
Which AI systems are vendors, partners, and suppliers using? When and how do they use these systems?供应商、合作伙伴和供货商正在使用哪些人工智能系统？他们何时以及如何使用这些系统？
Which products contain embedded or hidden AI functionalities?哪些产品包含嵌入式或隐藏的人工智能功能？
Which models are connected to internal databases?哪些模型连接到了内部数据库？
Which AI agents have access rights to internal databases and can initiate actions?哪些人工智能体（AI agents）拥有访问内部数据库的权限并可以发起操作？
Etc.等等。
The inventory should include a detailed list and description of which AI systems are used, how they are used, and when.清单应包含一份详细的列表和描述，说明使用了哪些人工智能系统、如何使用以及何时使用。
It should identify an internal responsible party, the intended use, its users, the type of data it processes, whether there are any integrations, the decision-making role, the level of autonomy, and how it affects customers, employees, or other individuals.它应确定内部责任方、预期用途、用户、处理的数据类型、是否存在集成、决策角色、自主程度，以及它如何影响客户、员工或其他个人。
One or more people should own the AI inventory internally, and it should be kept up to date.应由一人或多人负责内部人工智能清单，并应保持更新。
When a new AI system or a new use case is approved, there should be an internal process to add it to the inventory.当一个新的系统或新的用例获得批准时，应有一个内部流程将其添加到清单中。
The inventory is the primary map showing where AI is used within a company, and an AI policy will only be effective if this map is up to date and reflects what is happening on the ground.清单是显示公司内部人工智能使用情况的主要地图，只有当这张地图保持最新并反映实际情况时，人工智能政策才会有效。
After a new AI policy is published, and at set intervals, a company’s AI governance team should review the inventory and assess whether existing AI uses are adequate or need review.在发布新的人工智能政策后，以及在设定的时间间隔内，公司的人工智能治理团队应审查清单，并评估现有的人工智能使用是否恰当，或者是否需要重新审查。
3. Build the AI policy around risk tiers and controls3. 围绕风险层级和控制构建人工智能政策
Many businesses have adopted a risk-based approach internally (similar to how the EU AI Act classifies AI systems), and it is indeed an effective way to build an AI policy.许多企业在内部采取了基于风险的方法（类似于欧盟《人工智能法案》对人工智能系统的分类方式），这确实是构建人工智能政策的一种有效方式。
A company might classify AI systems internally into three or four tiers, with each tier involving a different set of controls and procedures before use is approved.公司可以将内部人工智能系统分为三个或四个层级，每个层级在批准使用前涉及一套不同的控制措施和程序。
For each risk tier, the company should establish which controls are needed, who to contact, and examples of AI use cases that fall into that category.对于每个风险层级，公司应确定需要哪些控制措施、联系谁，以及属于该类别的人工智能用例示例。
Here is a helpful example of a four-tier classification and control framework:这是一个四层分类和控制框架的实用示例：