AI policy and governance
Syxel Technologies helps Jamaican organizations put AI policy and governance in place, so everyone knows which AI tools can be used, for what, and with which data. Clear rules let you adopt AI with confidence and show customers, regulators and your board that it is under control.
Discuss AI governance
Why you need an AI policy now
In many organizations, AI use has started without any decision from management. Staff sign up for free tools, paste in documents and use the results in their work. Nobody knows which tools are in use, what data has been shared or who checks the output.
An AI usage policy fixes that. It sets out which tools are approved, what information may and may not be entered, when AI output must be reviewed by a person, and how new uses are approved. Without one, it is difficult to show that personal data is being handled in line with the Data Protection Act, 2020.
AI policy and governance aligned with the Data Protection Act
Several of the JDPA's data protection standards apply directly to AI use. Personal data must be processed fairly and lawfully, collected for specified purposes, and limited to what is needed. Data subjects have rights over their data. And the eighth standard restricts transferring personal data outside Jamaica unless the destination ensures an adequate level of protection, subject to exceptions in the Act. Many AI services process data overseas, so this needs checking before staff use them with personal information.
Our governance work connects those requirements to practical rules. We coordinate with our Data Protection Act compliance team so your AI policy and your privacy program say the same thing. This is general guidance rather than legal advice, and we are glad to work with your attorneys on specific legal questions.
What a governance framework includes
Policy is the starting point. Governance makes sure it is followed and kept current. Our team applies the COBIT governance framework and holds ISACA credentials, so we build AI governance into your existing management structures.
- AI usage policy: approved tools, permitted uses, prohibited data and review requirements.
- Roles and accountability: who approves new AI uses, who owns each tool and who handles incidents.
- AI inventory: a register of AI tools and uses across the organization.
- Risk and ethics review: a process for assessing privacy, accuracy, bias and security before new uses go live, including tools we help you build through AI implementation.
- Vendor assessment: questions to ask AI suppliers about data storage, retention and training on your data.
- Monitoring and review: periodic checks that the policy is followed and still fits the tools in use.
Governance services
AI usage policy
A clear, readable policy for staff, tailored to your organization and sector.
Governance framework
Roles, approval processes and oversight built into your existing management structures.
AI risk and ethics review
An independent assessment of an existing or planned AI use for privacy, fairness and accuracy risks.
Board and executive briefings
Sessions that help leadership understand their oversight responsibilities for AI.
How we build your AI governance
- Step 1
Current state review
We find out which AI tools are in use, how, and with what data.
- Step 2
Risk assessment
We identify the main legal, security and reputational risks for your organization.
- Step 3
Policy and framework
We draft the policy, roles and processes, and refine them with your leadership team.
- Step 4
Rollout
We help communicate the policy and train staff, often through our AI training workshops.
- Step 5
Review
We revisit the policy as tools, regulations and your use of AI change.
Who we work with
- Credit unions and financial services
- Healthcare
- Education
- BPOs
- Government agencies
- SMEs
Keep it running: AI support plan
Keep your AI tools and policies current as the technology changes.
Frequently asked questions
Do small organizations need an AI policy?
Yes, though it can be short. Even a one-page policy that names approved tools and lists information staff must never enter reduces risk considerably. Larger organizations usually need a fuller governance framework.
Does Jamaica have a specific AI law?
Organizations using AI with personal data must already comply with the Data Protection Act, 2020, which applies to AI processing like any other processing. Sector regulators and international partners may also have expectations, so a governance framework should be reviewed as the rules develop.
Is this legal advice?
No. We provide general guidance on governance, risk and data protection, not legal advice. For specific legal questions, please consult an attorney, and we are happy to work alongside your counsel.
How long does it take to put a policy in place?
It depends on the size of your organization, how many AI tools are already in use, and how many people need to review and approve the policy. A basic usage policy is quicker than a full governance framework.
What do you need from us?
A sponsor in senior management, access to people who use or manage AI tools, and any existing IT, security and data protection policies. We use these to make sure the AI policy fits with what you already have.
More ai solutions services
Put clear rules around AI
Tell us how your organization uses AI today and we will help you build a policy and governance approach that fits.