AI policy generation

What it generates

The AI drafts full policies with the structure auditors expect:

• Purpose (why this policy exists)
• Scope (who and what it applies to)
• Policy statements (the actual rules)
• Roles and responsibilities
• Enforcement
• Review cycle

Supported categories include Access Control, Data Classification, Data Retention, Incident Response, Business Continuity, Acceptable Use, Vendor Management, Change Management, Asset Management, Cryptography, Physical Security, BYOD, Remote Work, AI Use, and others.

Generating a policy

1. 1
   Open Compliance, Policies and click Generate with AI.
2. 2
   Enter the policy type (Access Control, Data Protection, Remote Work, etc.).
3. 3
   There is no framework picker. Your active frameworks and connected security capabilities shape which controls the draft addresses and the language it uses.
4. 4
   Optional: add requirements and context. Examples: "We are a healthcare company handling PHI," or "We do not allow personal devices on the corporate network," or "Emphasize the review cycle because our auditor flagged it last year."
5. 5
   Click Generate Policy. In about 10 to 20 seconds the full draft appears. Review, edit, save as Draft.

Evidence-aware drafting

For tenants with connected deep integrations, the AI can draft policies that reflect your actual environment. If Okta is connected and the AI is drafting an Access Control policy, it reads your actual MFA enforcement, password policy, and privileged-access configuration, and writes the policy to match what your systems actually do.

This closes the single biggest gap in traditional policy drafting: the drift between "what the policy says" and "what the systems actually do." If the environment changes later and diverges from the policy, Radius360 flags the drift as a risk in the register.

Framework-specific drafting

The draft structure and language adapt to your active frameworks. A SOC 2 Access Control policy reads differently from an ISO 27001 Access Control policy, and both read differently from a HIPAA Access Control policy, even though the underlying topic is the same.

When multiple frameworks are active, the AI produces a single policy that satisfies all of them, with footnote-style references to which framework each policy statement addresses. One policy, multiple framework credits.

Limits

AI policy generation is available on all paid plans. Counted against the same AI query budget as the GRC Assistant and AI risk scoring. See billing for per-plan quotas.

Generated policies are always marked as drafts. They require explicit human promotion to Active before they are considered published, so there is no risk of AI output going to production unreviewed.