Acceptance criteria
Apply a documented default rule until the service is assessed as sanctioned, restricted or prohibited.
Why it matters
New tools arrive faster than they can be assessed, so the default decides what happens in the meantime.
How to verify
A tool first used during the pilot receives the documented default treatment.
OWASP adoption context
Default treatment matters wherever employees can encounter a new AI service in the listed settings, before a full approval decision is available.
Framework mappings
Applying a documented default while a new service awaits assessment puts interim acceptable-use policy into operation. The default contributes to information-access and transfer restrictions only when its selected action actually restricts them; an applied permissive default is still a policy decision. ISO/IEC 27001: The chosen default must be approved and fit the organization’s risk treatment.
The interim rule records whether and under what conditions use may proceed before the service assessment is complete. It contributes to the proceed-or-do-not-proceed decision without replacing an assessment against the intended purpose and objectives.
A documented default for an unclassified AI service provides an interim responsible-use rule. The chosen default must be approved and fit the organization’s risk treatment; approval status is not the AI system’s intended function.