Policy Layer
Core conceptThe documented governance commitments, framework references, and procedural controls that describe what should happen when AI systems operate.
Policy states what people should do. A technical control decides what the system can do. For financial institutions, AIRG Section 5 expects controls to be tested by 7 October 2028. Aivance maps policy to configured controls, tests them and records the evidence.
How to recognise the gap
Read through your AI governance controls. How many require a person to actively act before they take effect? Those are policy layer controls. Enforcement layer controls operate regardless of whether the human acts.
This definition reflects how Aivance uses the term in engagements and deliverables. Where regulatory frameworks use overlapping but distinct terminology, the relevant framework definition applies in compliance contexts.
Governance built on precise terms.
Every Aivance engagement produces specific, auditable outputs. The 30-Minute Enforcement Gap Review is complimentary, with the same precision: one call, one missing control, one diagnosis on Aivance letterhead within 48 hours.