SECAI Core · phase 8 of 15
Policy as code
The policy is defined, enforced, and managed using programming code rather than manual procedures
The Explain card
- Plain English
- Policy as code means rules are written, enforced and managed as program code rather than as manual procedures. The policy runs automatically wherever it is deployed.
- Example
- An organisation encodes "no model may be deployed without a completed risk assessment and an approved data source" as a rule in its CI/CD pipeline. A deployment missing either artefact fails the build, and the failure is logged as evidence.
- Why it matters
- Manual policy relies on people remembering. Code enforces the rule every time, produces an audit trail, and can be version-controlled and tested like any other software.
- Hook
- The rulebook that refuses to merge.
Where it sits in the deck
Phase 8: Governance, Risk, and Compliance Frameworks
Individual controls need a governance envelope — introduce the risk and compliance structures, standards bodies, and regulations that frame AI accountability at scale.
