Governance, Security & Getting Buy-In

TREASURY AI POLICY
Governance framework for the use of Artificial Intelligence in treasury operations

Document owner: [Treasury Manager / Head of Treasury]
Effective date: [DD/MM/YYYY]
Review frequency: [Quarterly / Semi-annual / Annual]
Approved by: [CFO / CTO / Head of Risk]
Version: 1.0

This document establishes the governance framework for the use of AI tools within the Treasury function. It defines approved tools, data handling rules, audit requirements, validation procedures and escalation processes. All treasury team members must read, understand and comply with this policy before using any AI tool for treasury work.

1. APPROVED AI TOOLS
Only tools listed below may be used for treasury work. Any other AI tool, including free-tier consumer products, is prohibited.
Tool | Status | Authorized users | Data scope | Conditions
[Tool] | [Approved / Under review / Prohibited / Requires approval] | [Role level]+ | [Sanitized data / Internal docs / Nothing] | [Conditions]
Review this list quarterly. New tools must be evaluated by IT Security before treasury use.

2. DATA CLASSIFICATION
When in doubt, treat data as RESTRICTED.
PUBLIC / OPEN: can be sent without modification. Public market rates, generic policy questions, formatting requests, methodology questions, general treasury calculations.
INTERNAL / SANITIZE: may be sent only after removing identifying details. Bank statements (remove counterparty names), forecasts (remove entity identifiers), deal terms (anonymize parties), payment files (mask IBANs), internal reports (strip personal names).
RESTRICTED / NEVER: must never be sent to any external AI tool. Bank account numbers, passwords, API keys, employee personal data, unexecuted M&A details, full counterparty names in active deals, board-level confidential information, SWIFT credentials.

2.1 Sanitization guidelines
- Replace company names with Entity A, Entity B, etc.
- Replace bank names with Bank 1, Bank 2, etc.
- Replace counterparty names with Counterparty A, Counterparty B, etc.
- Mask IBANs: show only the last 4 digits (****1234).
- Remove internal reference numbers that could identify deals.
- Replace employee names with role titles (Treasury Analyst, CFO).

3. AUDIT TRAIL
Every AI use that produces an output used in a decision, report or process must be logged with: timestamp, user, AI tool + model, process/workflow, input summary, output type, validation status, final disposition.
Start with a shared Excel log. Move to automated logging for Level 3+ workflows.

4. VALIDATION RULES
AI output never goes directly into a report, payment file or communication without human validation.
- Four-eyes principle: every AI output is reviewed by a human before it is used outside treasury.
- Threshold review: outputs involving amounts above [EUR 100,000] require manager-level review.
- Spot-check: for bulk processing, verify at least 5% of auto-matched items against source data.
- Source verification: cross-check at least 3 key figures in any AI-generated report against source documents.
- Format validation: verify the output matches the required template before distribution.
- No blind copy-paste: AI-generated text must be read and understood before it goes into any document.

5. ESCALATION PROCESS
1. Stop and revert: do not use the AI output. Revert to the manual process immediately.
2. Document the failure: input, expected output, actual output, what went wrong.
3. Notify the Treasury Manager within the same business day, with the failure documentation.
4. Root cause: bad input data, incorrect prompt, AI hallucination, tool malfunction, or user error?
5. Fix and retest on the same data before re-enabling.
6. Update this policy if the failure reveals a gap.

ACKNOWLEDGMENT
I have read, understood and agree to comply with this Treasury AI Policy.
Name: ________  Signature: ________  Date: ________  Role: ________