Three months on: the quarterly review of that one page
You wrote it in January for the February deadline. It is now out of date, and updating it takes twenty minutes.
If you followed the advice in this blog, you wrote a single page in January: which AI tools we use, what may go in, who checks the output, who to ask, and a line confirming staff have read it. It is now three months old, and it is wrong.
Not badly wrong. Out of date in three predictable ways.
The three things that have changed since January
The tool list is incomplete. Not because anyone broke a rule, but because AI features keep arriving in software you already own. Something in your Microsoft tenant, your accounting package or your phones gained a capability since January without anyone deciding to buy it.
Someone has started using something new. In every company. The question is whether you find out during a twenty-minute review or during an incident.
The rule has met a case it does not cover. There is always one. Usually it is a grey area — a customer name that is also a public company, an anonymised document that is not quite anonymous. Somebody made a judgement call and did not tell anyone, because there was no obvious reason to.
The twenty-minute version
- Ask three people what they used AI for last week. Not a survey. Three conversations. You will learn more than any audit produces.
- Add what is missing to the list. Including the features nobody procured.
- Add one clarification. Take the grey case that came up and write the answer down. One sentence. The page improves by exactly one sentence per quarter, which is the right rate.
- Change the date. The single most important edit. A page dated January is evidence you did something once. A page dated April is evidence you maintain it.
Why the date matters more than the content
Because the question you will eventually be asked — by a customer’s procurement, an insurer or a lawyer — is not « is your policy perfect? » It is « do you actively govern this? »
A short page reviewed four times a year answers that question. A thorough document written once and never touched answers it badly, and the date at the top tells the reader which one they are holding.
Put the next review in the calendar before you close the file. July, before the August deadline.