Most organisations I work with have an AI policy now. It names approved tools, prohibited data categories, a review process, and someone accountable for the policy itself. It is usually competent work by competent people.
It also does not touch the thing that goes wrong.
Where the failures actually sit
The failures I see are not policy breaches. Nobody pasted customer records into a public assistant. What happens is smaller and much harder to write a rule about.
An analyst asks a model for a market summary and gets one that is fluent, plausible and directionally wrong. It goes into a pack. The pack goes to a steering group. Somebody senior reads a number out loud, and from that moment the number belongs to nobody. The analyst did not assert it. The model cannot assert anything. The steering group inherited it as established.
That is not a tooling failure or a data failure. It is an ownership failure, and it happens at the altitude where four specific decisions live.
The four decisions
Someone has to set the objective, in words specific enough that a wrong answer is recognisable. Someone has to direct the work, which means choosing what the model is being asked to do rather than accepting what it offers. Someone has to check the output against something other than whether it reads well. And someone has to own the outcome, by name, after the decision is made.
Nothing in a tool policy assigns any of those four. They are not technology questions. They are the ordinary content of management, which is why the organisations that struggle most with AI tend to be the ones that were already vague about who decides what.
What I would do instead of another policy
Take one recurring decision that now has AI somewhere in its production path. Write down who holds each of the four. If two of them land on the same person and that person is junior, you have found a real problem, and you found it without a framework, a maturity model or a tool.
The uncomfortable version of this argument is that AI has not created a new governance discipline. It has raised the cost of governance you were already not doing. That is a less appealing thing to sell, which is roughly how you can tell it is the true one.