Originally published at getaisafetycertified.com.
TL;DR
A one-page AI safety policy is the artifact Module 0 asks you to write. A five-page pack adds owners, logs, human review, and allowed tools. Neither page is a security architecture. Both are how a deployer proves they know Safety ≠ Security.
Key takeaways
- Safety = protect people from the model (accidental harm: bias, hallucinations, leaking PII, over-reliance) — guardrails. Security = protect the model from attackers (adversarial: prompt injection, breaches, exfiltration). Intent is the key distinction.
- Page one: owner, allowed uses, what never goes in a prompt.
- Pages two to five: disclosure, logs, incident path, vendor list, review cadence.
Why one page first
HR will not sign a 40-page governance PDF this quarter. They will sign a page that names the owner, bans secrets in prompts, and says who can override the model. That is the free template. Write it in your classroom after the three public videos.
What the five-page pack adds
The longer pack is Module 5's outcome, not a public download. It turns the one-pager into something a deployer can show counsel: purpose of each system, human review triggers, logging, retention, vendor inventory, and a date to revisit. Auditors ask "who decided this model could talk to customers?" The five-pager answers with a name.
What never belongs in either document
Do not paste a CISO red-team runbook into the staff policy. Security controls belong with security. The safety policy is for accidental harm: bias, hallucinations, leaking PII, over-reliance. If you mix the two, builders skip the file and CISOs ignore the one-pager.
Enter the free classroom
Watch Module 0 — Why AI Safety Is Not Security — with no login, at getaisafetycertified.com/learn/m0. Unlock M1–M5 for $199. If you are a deployer, also read the EU AI Act page.
Get AI Safety Certified — CASF™ Foundations is the identity-verified AI safety certification for everyone who uses AI on the job. Start free with Module 0.
Top comments (0)