dutira
Book a Demo

Module B · AI Policy & Attestation

Your AI policy should do morethan sit in a document.

Upload the policy, review the requirements and controls it suggests, approve what applies, ask staff to acknowledge the key requirements, and show management who has — version by version.

Book a Demo Free AI governance check Phase 1 · available now

From document to requirements

Upload a PDF, Word or text policy. The obligations it places on staff are extracted, classified by indicative risk and matched to suggested controls — as suggestions for an administrator to approve, never applied automatically.

Owners, versions and dates

Every policy has an owner, a version history with approval dates, and a record of which version each employee acknowledged.

Attestation that means something

Staff read the policy, complete assigned training, acknowledge the key requirements and submit a dated attestation. Administrators see completion and outstanding acknowledgements, per version.

See it work

Try it.

An interactive demonstration with a fictional firm’s data.

Illustrative demo · fictional data
AI Policy & Attestation — Halden Row Wealth (illustrative)Illustrative

5 obligations found by the product’s rule-based extraction; the narrative paragraph was skipped. Each is a suggestion — approve the ones that apply and record which controls you use.

  • high riskConfidentiality

    Employees must not disclose restricted client information to unauthorised AI services.

    • technical: Detect the configured sensitive-data categories in prompts and uploads; mask or block prohibited inputs where technically supported. Pattern detection has limits and is not a guarantee.
    • technical: Apply model data ceilings so restricted information cannot be sent to an external model through the workspace.

  • high riskRegulatory conclusions

    AI-generated regulatory conclusions must be independently verified before they are relied on or shared.

    • technical: Flag the configured high-risk activities (advice, promotions, regulatory conclusions) and hold them for a named human review before release.
    • human review: Require a named reviewer to record the primary sources checked and the review decision; keep the approval history.

  • high riskAI agents

    AI agents require approval before deployment.

    • agent: Register each agent with a business owner, a risk classification and an approval status before deployment; keep a basic agent inventory.
    • human review: Route agent deployments through the AI use case approval process; significant actions need a named human approver.

  • medium riskAccountability

    Employees remain responsible for work submitted using AI.

    • attestation: Ask employees to acknowledge this requirement and attest to it on each policy version.
    • human review: Human-review checkpoints with named ownership and a review record for designated outputs.

  • medium riskCritical thinking

    Employees must critically assess AI-generated work before using it.

    • technical: Show a verification reminder on designated high-risk requests: AI-generated content may contain errors; verify against primary sources.
    • training: Assign awareness training on hallucinations, leading prompts, confirmation bias and sycophancy, with a knowledge check and completion record.

Capabilities

What it does today — and what is coming.

In the product today

  • AI Policy Intelligence: a six-stage administrator workflow — upload, analyse, review, configure, publish, monitor
  • Policy library with owners, categories, audiences and a full version history with approval dates
  • Upload of PDF, Word or text policies, with text extraction; documents stay in your tenant and are not sent to a model unless you run the model-assisted analysis
  • Each extracted requirement shows its source passage, category, priority, control type, enforceability and confidence; uncertain ones are flagged for a person, and all are company policy requirements, kept distinct from FCA obligations
  • My AI Responsibilities: one page for each employee — current policy and key requirements, approved tools, restricted activities, learning, attestations, approvals and recent policy changes
  • Requirement extraction: obligation sentences classified by indicative risk, with suggested technical, human-review, training and attestation controls from the firm’s catalogue; a model-assisted pass when an approved provider is available
  • Administrator approval of every suggested requirement — approval records which existing controls apply; it never configures a control
  • Approved key requirements shown to staff on the policy and in attestations
  • Version-specific acknowledgements, and attestation cycles that re-ask after a policy change
  • Employee attestation flow: read, train, acknowledge, confirm, submit — with exceptions that can be declared and reviewed
  • Administrator view of completion and outstanding acknowledgements
  • AI awareness courses with knowledge checks and completion records (hallucinations, confidentiality, accountability, verification, leading prompts and sycophancy, safe use of agents, when to escalate)

Planned

  • Notifications by email and Teams when a policy changes or an attestation is due
  • A policy template library for firms starting from scratch
  • Mapping of each requirement to the FCA obligations it supports

FCA AI governance expectations

How it relates to the FCA’s October 2026 publication.

The FCA’s AI in financial services: good practice and areas for improvement (19 October 2026) shares examples from industry. In its own words: “They do not create new requirements.” There is no standalone FCA AI rulebook; existing rules apply.

Below, each example it describes, and how this module supports a firm’s own approach.

Clear policies and procedures for AI use, and training so that staff understand them

Dutira: The policy library, key requirements and assigned training give every employee the same, versioned understanding.

FCA AI good practice §3.1 — Governance frameworks Good practice

Staff accountability for the outputs they produce with AI

Dutira: Attestations record that each person acknowledged the requirements in force, by version and date.

FCA AI good practice §3.4 — Human oversight Good practice

Documented, auditable governance that senior managers can evidence

Dutira: Approval decisions on requirements, acknowledgements and attestations are in the audit trail and the evidence pack.

FCA AI good practice §3.3 — SMF and reasonable steps Good practice

Training on the limits of generative AI, including confident errors

Dutira: Courses on hallucinations, leading prompts and sycophancy, with knowledge checks — not a measure of anyone’s judgement.

FCA AI good practice §2.2 — Consumer understanding Good practice

The rules behind it

Existing rules continue to apply when firms use AI. Which apply depends on each firm’s permissions and business.

  • Rule Binding on the firms it applies to
  • Guidance How the FCA expects rules to be met
  • Good practice Illustrative examples; no new requirements

Your responsibility. Your firm writes its policy and decides which requirements and controls apply. Extraction suggests; an administrator decides; nothing is enforced on the strength of an interpretation alone. Dutira is not approved or endorsed by the FCA and does not guarantee regulatory compliance.

One platform, launched in phases

See it with your own policies.

A 30-minute walkthrough, tailored to your firm.

Book a Demo Free AI governance check