Before writing an AI policy, CIOs should answer five key questions about scope, ownership, data, human oversight & enforcement.