E010—Establish AI acceptable use policy

Core - This should include:

- Defining prohibited AI usage for end-users. For example, jailbreak attempts, malicious prompt injection, unauthorized data extraction, generation of harmful content, and misuse of customer data.

Core - This should include:

- Implementing detection and monitoring tools. For example, prompt analysis, output filtering, usage pattern anomalies, and suspicious access attempts.

Core - This should include:

- Implementing user feedback when policy is breached. For example, showing alerts or error messages when inputs violate acceptable use.

Supplemental - This may include:

- Real-time monitoring, blocking, or alerting capabilities. - Maintaining logging and tracking systems. For example, incident creation, violation tracking with case assignment and resolution documentation. - Conducting regular effectiveness reviews. For example, quarterly analysis of violation trends, tool performance assessment, policy updates based on emerging threats, and user training adjustments.