⚡ Quick Summary
Approved by the Prysmian S.p.A. Board of Directors in October 2025, the AI Governance - AI Policy establishes mandatory operating principles, risk management practices, and behavioral rules for deploying artificial intelligence across all Prysmian Group entities. Grounded in the European Union AI Act, Italian Law No. 132/2025, GDPR, ISO/IEC 42001, ISO/IEC 23894, and NIST AI RMF 1.0, the document addresses traditional, generative, and agentic AI systems. It explicitly bans prohibited AI use cases, strictly regulates enterprise data and intellectual property sharing, restricts the execution of unverified AI-generated code, mandates human oversight on impactful decisions, and defines cross-functional governance responsibilities spanning executive IT, cybersecurity, compliance, DPO, legal, HR, and procurement units.
🧩 What's Covered
The policy lays out an end-to-end organizational and operational blueprint for enterprise AI adoption:
- Taxonomy & Technology Scope: Defines clear operational boundaries across Machine Learning, Deep Learning, Generative AI (including chatbots and internal document retrieval), and Agentic AI architectures powered by Large Action Models (LAMs).
- Ethical & Operational Principles: Incorporates core tenets derived from ALTAI and corporate ethics, focusing on lawfulness, accuracy, transparency, fairness, non-discrimination, robustness, safety, human supervision, and institutional accountability.
- Prohibited AI Practices: Explicitly forbids systems utilizing manipulative techniques, social scoring, vulnerability exploitation, untargeted facial recognition scraping, remote biometric identification for law enforcement, and emotion recognition in workplaces unless deployed for specific security reasons.
- Enterprise Usage Guardrails: Prohibits using corporate credentials on public consumer AI tools (e.g., ChatGPT), running unapproved AI plugins or APIs, and executing GenAI-generated code on company systems without authorization.
- Data Governance & IP Protection: Aligns data uploads with corporate classification levels (Confidential Restricted, Confidential, Internal, Public). Forbids exporting proprietary data or trade secrets to unvetted third-party AI models and mandates copyright compliance for training and output use.
- Organizational Model: Assigns explicit cross-functional duties to the Compliance & DPO Office, Information & Cybersecurity, HR, Purchasing, the Office of Corporate CIOs & Governance IT, and the multidisciplinary AI Governance Committee for risk classification, auditing, system inventory maintenance, and incident escalation.
💡 Why it matters?
This policy serves as a practical, real-world blueprint of an industrial multinational operationalizing strict European regulatory frameworks (the EU AI Act and national legislation like Italian Law No. 132/2025). Rather than treating AI in isolation, Prysmian bridges cybersecurity, intellectual property, data classification, and enterprise risk management into concrete employee and procurement mandates, offering governance practitioners a clear corporate benchmark.
❓ What's Missing
While the policy defines operational expectations and structural roles, it functions as a high-level policy rather than an implementation playbook. Detailed technical thresholds for system audits, standardized evaluation rubrics for generative model quality/drift, exact procurement contract clauses, and specific criteria for qualifying automated decision workflows without human-in-the-loop oversight are left to subordinate operational procedures and guidelines.
👥 Best For
Chief Information Security Officers (CISOs), Chief Compliance Officers, Data Protection Officers (DPOs), enterprise AI governance leads, legal counsel, and risk managers designing board-approved AI governance and acceptable use policies aligned with EU regulations.
📄 Source Details
Title: AI Governance - AI Policy
Author / Approver: Approved by Prysmian S.p.A. Board of Directors
Publication Date: October 29, 2025
Document Reference: Approved Corporate Policy (Prysmian Group)
📝 Thanks to
Prysmian S.p.A. Board of Directors and corporate governance functions for developing and approving this structured organizational policy framework.
