Controls & Monitoring
AI Agent Risk Monitor
Monitors agent actions for risky or unexpected behavior.
Controls & Monitoring
AI Security Policy System
Written AI security policies are drafted, mapped to your real systems, and checked against how those systems actually run today.
Customers, investors and auditors increasingly ask for your AI security policies, and a blank page is a hard place to start. This system drafts or updates written policies for acceptable use, data handling, incident response and access, maps each one to the systems it covers, then checks how those systems actually run today. You get the documents and a clear list of gaps.
- Written AI security policies in your own language and templates
- Each policy mapped to the systems it actually covers
- A gap check showing where practice and policy differ
$4,400
20–30 working days
Optional maintenance $249/mo
What it is
AI Security Policy System is an agent that drafts and maintains written security policies covering your AI systems, such as acceptable use, data handling and incident response, then checks your current setup against them for gaps. It is a governance and documentation job, not a technical scanning product.
Why businesses buy it
A missing or outdated AI security policy rarely causes trouble on its own. It causes trouble at the worst moment: a security questionnaire that stalls a deal, an investor asking for documents, or an incident with no agreed response. Writing policies from scratch takes weeks of senior time most teams cannot spare. This system produces policies that describe your real setup and shows where practice falls short. The written scope sets how many systems and policies are covered before you order.
Problems this solves
AI security policies are missing, outdated or scattered across files
The system drafts written policies for your AI systems, covering acceptable use, data handling and incident response. It works from your existing documents, up to twenty, so drafts match how you operate.
Nobody has checked the real setup against the written policy
It compares the setup of up to three systems with your policies and lists the gaps in a findings report. Each gap names the policy clause it relates to.
Policies fall behind as new AI tools are added
The system is configured to maintain your policies, so updates can be drafted when your setup changes. Up to five policies or controls are set up in this build.
Clients ask for AI security documents you cannot produce
You finish with written policies and a findings report you can share on request. The admin guide and recorded handoff show your team how to keep them current.
A good fit if
You need written AI security policies to show a customer, investor or compliance reviewer, and do not have them yet.
Your existing policies, if any, have not been updated since before you started using AI systems in the business.
You want each policy mapped to the specific systems it applies to, not a generic document nobody references.
You want a gap check between what your policy says and what your systems actually do today, not just a template to fill in.
Not the right fit if
You want active technical monitoring rather than written documents; see AI Security Monitoring, for ongoing, centralized watching.
You want your code and dependencies checked, not policy documents; see AI Application Security Agent, for continuous scanning.
You want a one-time technical assessment of your security posture; see AI Security Audit, for a point-in-time findings report.
You want technical enforcement of who can access your AI systems, not a written access policy; see AI Access Control System.
How it works
- We gather your existing policies and requirements. Any current documents, plus any customer, regulatory or investor requirements you already know you need to meet, form the starting point rather than a blank page.
- Written policies are drafted or updated for your AI systems. Acceptable use, data handling, incident response and access rules are covered, written in your language and using your existing document templates where you have them.
- Each policy is mapped to the systems it applies to. Rather than one generic document, individual sections are tied to the specific AI applications and integrations named in your scope.
- Current practice is checked against the written policy. Within the systems in scope, we look at whether configuration and day-to-day practice actually match what the policy says should happen.
- Gaps are logged with what to change. Where practice and policy do not line up, the gap is written up clearly enough for your team to act on, without us implying a technical fix was applied.
- You receive the finished policy set and gap log to keep. A recorded 60-minute session walks through the documents and the gaps found, and confirms an agreed review cadence going forward.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- Written authorization confirming which systems the policies should cover.
- The list of AI applications and systems you want policies mapped to.
- Any existing policies or templates you already have, even in draft form.
- Any known customer, regulatory or investor requirements the policies need to meet.
- A named IT or security owner who can confirm current practice during the gap check.
- Admin access and API keys for every connected system, shared by adding our team as a user or creating a key you control, never by email.
- One decision-maker who can approve the final policy wording and sign off the launch.
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
Systems, existing policies and scope confirmed.
Weeks 1–2
Policies drafted or updated for your AI systems.
Week 3
Policies mapped to specific systems and requirements.
Weeks 3–4
Current practice checked against the written policy.
Week 4
Your review and two rounds of changes to the wording.
Go-live
Policy set delivered, recorded handoff session, support begins.
| Option | Delivery time | Price |
|---|---|---|
| Standard | 20–30 working days | $4,400 |
| Express | 15–25 working days | $5,150 |
| Rush | 10–20 working days | $5,950 |
What you receive at handover
- AI Security Policy System configured and deployed in your environment
- Drafted AI security policies, such as acceptable use, data handling and incident response (up to five policies or controls)
- A gap findings report comparing up to three systems with those policies (recommendations; fixing the gaps is not included)
- Workflow, prompt and guardrail configuration, with connections to the agreed systems
- An admin guide and a recorded 60-minute handoff session
- 30 days of post-launch support
Expected benefits and how to measure them
- Can make client security questionnaires quicker to answer.
- Helps keep your policies in step with the AI tools you actually run.
- Gives your team a clear, written list of gaps to plan around.
- Open policy gaps
- Count the gaps in the first findings report. Recount at each later check and track how many have closed.
- Security questionnaire turnaround
- Time how long questionnaires take to answer before the policies exist. Compare with the next few after handover.
- Policies past their review date
- Count them each quarter from the policy record.
Before you start: Gather any AI or security policies you have now, with their last review dates. Note how long your last client security questionnaire took.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
The build price is one-time and covers the policy work itself. Ongoing costs are roughly $20 to $300 a month in your own accounts, for hosting, logging and monitoring tools you may adopt to close the gaps found, not for the policy system itself.
Any AI model usage during the drafting and gap check is billed directly to your accounts, so nothing runs through a system we control.
Ask about running costsCustom requirements
If you need something outside the Scope Card, such as policies covering more than three systems, add a note at checkout. You get a written Change Quote, and that work only starts once you accept it. Larger or bespoke projects go through the Custom AI request form instead.
Request a custom versionKeep it running
Monthly maintenance includes change hours for work such as updating a policy after a new system is added or a requirement changes. It starts after the 30 days of included support and can be cancelled any month.
$249/mo (the minimum fee, includes 2 change hours)
Optional. Starts after the post-launch support period. Cancel any month.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | A policy template tool charges a recurring subscription for document access | A compliance consultancy quotes after a scoping call | Ours is one fixed price, shown on this page before you buy |
| Scope | A policy template tool gives you a generic document to edit yourself | An agency agrees scope during the engagement | Ours is written and mapped to your named systems |
| Delivery | A policy template tool still leaves the drafting work to you | A compliance consultancy engagement often takes weeks to schedule | Ours has a fixed delivery time shown before you buy, with faster options |
| Gap checking | A policy template tool does not check your systems against the document | An agency build depends on what was agreed | Ours checks current practice against the policy and logs gaps |
| Certification | A policy template tool does not certify anything on its own | An agency may offer certification as a separate service | Ours is a review and documentation workflow; no certification is implied |
Questions about this product
Is AI Security Policy System a technical product or a documentation product?
It is a documentation and governance product. We draft or update written policies covering your AI systems and check current practice against them, but we do not scan code, monitor traffic, or enforce technical controls. For that, AI Security Monitoring or AI Application Security Agent are the technical products in this cluster.
What policies does AI Security Policy System actually produce?
Typically acceptable use, data handling, incident response and access rules for your AI systems, written in your language and mapped to the specific applications named in your scope. The exact set depends on what you already have in place and what gaps the intake conversation surfaces along the way.
How much does AI Security Policy System cost to run each month?
The policy documents themselves cost nothing to run once they are delivered. If you adopt monitoring or logging tools to close the gaps the work identifies, expect roughly $20 to $300 a month in your own accounts for those tools. Updates to the policies later fit inside monthly maintenance. The one-time build price for each delivery speed is shown in the price panel on this page.
Does the gap check behind AI Security Policy System fix anything automatically?
No. The gap check compares your written policy against current practice and logs where they do not match, with enough detail for your team to act on. Implementing a technical fix, such as tightening an access rule, is separate work, often covered by one of our technical security products.
Who owns the finished policy documents?
You do. The policies are delivered as documents in your own templates and formats where possible, yours to keep, edit and circulate however you need, including to customers, investors or compliance reviewers, without any ongoing dependency on us or our systems. We keep no separate copy that would lock you into working with us for future updates.
Can policies be updated as our systems change?
Yes. Updating a policy after a new system is added or a requirement changes fits inside the monthly change hours that come with maintenance. Extending the policy set to cover more than three systems comes through a Change Quote, priced and agreed with you before that work starts. This keeps your policies from going stale the moment your AI systems change or expand.
How is AI Security Policy System different from AI Security Audit?
AI Security Audit is a technical, point-in-time review that tests your systems and produces a severity-ranked findings report. AI Security Policy System is a documentation job that drafts written policies and checks practice against them. Some buyers use both together, starting with whichever gap matters more right now.
Put your AI security policy in writing, properly mapped.
Order AI Security Policy System and receive written, system-mapped policies with a gap log, delivered on a fixed delivery date.
Works well with
Controls & Monitoring
AI Security Monitoring
Centralizes security events from AI systems with alerting.
Controls & Monitoring
AI Agent Permission System
Defines and enforces what each AI agent may access and do.