Which of the following is the MOST important course of action for an organization prior to allowing end users to utilize an AI tool?

An AI policy establishes the governance framework that defines how AI tools may and may not be used, who is responsible, what data is permissible to input, and what oversight is required. Without this policy, end users lack guidance on appropriate behavior, and the organization has no enforceable standard against which to assess risk or compliance. Policy creation is the foundational prerequisite that enables all other AI controls to function effectively.

Updating the disaster recovery plan is an important but secondary operational consideration that should follow policy establishment, not precede user access.

Baseline performance metrics are operational controls that are important after deployment but are not the most critical prerequisite before allowing user access.

Cybersecurity insurance is a risk transfer mechanism, not a risk control, and does not substitute for governance policy as a prerequisite for safe AI use.