“Surely writing a security policy is just stating the bloody obvious? Isn’t security just general knowledge? Can’t we trust everyone, AI included, to do the right thing properly?”
I’m afraid not.
So why do we even need a security policy? The short answer: for some businesses it’s a legal requirement. That becomes a contractual requirement with your customers, and you pass it on to your suppliers. It’s probably also a condition of your cyber insurance policy.
If you don’t know what your legal and contractual requirements are, you’re a bozo. Sorry, not sorry.
You may have heard of COPPA, HIPAA, GDPR and the FTC. Most people are clueless about them. They think a useful contribution in a meeting is “What about COPPA?” or “We need to be GDPR compliant”. Throwaway comments to sound clever in front of the boss. Someone in the business needs to understand in detail what these are, and a lot more besides, and which ones apply to the business. It’s not general knowledge.
Why is that clause in the customer contract?
Usually the law put it there. Whether you agree or not, the law is probably there to protect consumers from your business being crap.
I’m not a lawyer, and neither is AI. But do some simple searches, like “What are the likely legal information security requirements for my business?” If you deal with children, health, finance or people’s identities, there are requirements. Whether you or your customers are in California, Texas, New York, Massachusetts or Europe, that’s a very broad list. You can’t ignore it.
And it isn’t vague. It’s very specific. The COPPA Rule, for example, requires a written security programme, named employees to coordinate it and a risk assessment at least once a year. COPPA Rule, §312.8.
What did you agree to?
Look at what your contracts actually say. A common one requires “a written information security program” with “appropriate” safeguards. Another wants security “in accordance with generally accepted industry standard practices”. UK contracts ask for “appropriate technical and organisational measures”, with the detail in an annex. Some name the Massachusetts statute outright. Sample contract clauses.
Appropriate to what? Which industry standard? Who decided, and when did they last check?
Asking a model to “follow best practices” leaves all of that to a guess, at best.
Being trusted to run the business means you get to decide how the company keeps that promise. If your answer is “however I feel like doing it, I’ll use my common sense”, you shouldn’t have that responsibility. Someone has to decide how things are done, write the decision down where the team and its agents will find it, and say who can authorise an exception.
What happens if you get it wrong?
Break the law or a contract term and the consequences stack up. Contractual penalties, fines, lawsuits. You lose contracts. You lose customers. Your insurance may not pay out. The business goes under. You get fired. Other people get fired. Serious stuff can happen.
If you think I’m being overly dramatic, do a search: “What happens if I fail to comply with GDPR, COPPA, the FTC rules or HIPAA? Show me example penalties for companies similar to mine.”
What about AI agents?
AI agents have to comply too, and you have to control them the way you control people. Agents need it all written down. Not a few lines in your CLAUDE.md, but a long list of very specific ways of doing things. Honestly, I find agents easier to control than people.
AI has made execution much cheaper and much quicker. Security tools that were expensive and hard to set up are cheap and easy. ,The cost of compliance has come down. But that speed of execution means security measures need to be in place in hours and days. We don’t have a year to grow into a secure organisation. More likely days or weeks.
If you don’t know your legal and contractual obligations, it’s naive to assume general security practice covers them. If you think every developer and every AI agent can decide for themselves how to handle customer data, you’re badly wrong.