The AI Policy Manager You Need Tracks the Rules and Writes the Brief

What Does an AI Policy Manager Actually Do on a Monday?

A legislative staffer calls on a Thursday asking where your organization stands on a disclosure bill that gets marked up Monday. Your general counsel has not read it. Your product team has three deployments that would fall under it. Somebody has to read the bill, map it to what you actually run, and write the two-page brief your executives will read between meetings. That person is the AI policy manager.

The beat has four standing pieces. One: the internal use policy, the document that tells everyone which tools are allowed against which data, kept short enough that people read it. Two: the tracker, a live view of federal rulemaking, state bills and sector guidance, with a column that says what each one would change here. Three: the brief, which turns the tracker into a decision an executive can make in ninety seconds. Four: the room, where the same person sits with a regulator, a works council, a school board or a legislative staffer and answers questions in plain language.

Inside government there is a fifth piece: standing up the governance body itself. Federal agencies were directed to designate Chief AI Officers and convene AI governance structures, and GAO's September 2024 review found agencies working through those management and personnel requirements ¹. Someone writes the charter, seats the members, and keeps the system inventory current. That work is more secretariat than think tank, and candidates who only want the think tank half tend to stall in month three.

The school and district version is starker. More than half of district recruiters now use AI tools in teacher hiring, while only about one in ten districts have set any AI policy, and almost none of those policies cover hiring ². The first AI policy hire in that setting is not refining a mature program. They are writing page one while the tools are already in use. Johns Hopkins' school of education now treats AI leadership as its own career path in K-12 and higher education, pushed there by state-level requirements for AI integration and oversight ³.

Which Backgrounds Produce an AI Policy Manager Who Holds Up?

Four feeders produce most of the good ones: legislative and regulatory affairs staff who already know how a bill becomes an obligation, privacy and data-protection people who have run a program with real enforcement behind it, sector policy analysts from think tanks and trade associations, and agency or district administrators who got handed AI on top of an existing job and did it well.

The unexpected ones are worth a second look. Standards-committee participants, the people who sat through NIST or ISO drafting sessions, arrive knowing how a control gets written and why the wording matters. Clinical research compliance managers have already governed a system where a documented deviation is a real event. Election administrators have run a public-trust process under adversarial scrutiny with no margin. Reporters off a technology beat can explain a system to a hostile audience, which is half the job. What none of these people arrive with is the internal map, and that is the part you can teach in a quarter.

The tells that separate a real practitioner from a performed one are cheap to check. Ask what changed in the last revision of a framework they claim to work from: a real one names the clause and why it moved. Ask them to walk you through a system they wrote policy for, and a real one describes where the model sits, what data reaches it, who can override the output, and what happens when it is wrong; a performed one describes a risk taxonomy. Ask what they got wrong, and the honest answer is usually a policy that got ignored because it was unenforceable, plus what they changed. If every example is a keynote, a panel or a framework diagram, you are hiring a summit circuit, not an operator.

One more filter: this person has to be able to say no to a senior executive on a Friday and still be trusted on Monday. That is a temperament, not a credential. The same requirement shows up next door in the financial AI governance officer role, where the no is about capital rather than reputation.

How Did This AI Policy Manager Learn the Tools Instead of the Talking Points?

Practice is the separator, not vocabulary. The strong candidates have built something with the models they write rules about: a bill-tracking pipeline that tags and summarizes legislation overnight, a retrieval setup over their own policy corpus, a red-team pass on a vendor's chatbot before the contract got signed. Ask what it got wrong and they answer immediately, with the case that embarrassed them.

The practice matters because it changes what they write. A person who has watched a model produce a confident, correctly formatted citation to a statutory section that does not exist writes a verification step into the policy. A person who has only read about hallucination writes a sentence asking staff to be careful. The first is operable and the second is decoration.

Ask for the mechanics of their own checking. Good answers sound like this: every statutory cite in a brief gets pulled from the primary text before it goes out; the tracker's summaries are spot-audited against the bill each week; anything that will reach a regulator gets read by a second person who did not use the tool. That habit of testing a claim against something outside the conversation is the single most transferable skill in the role, and it is the same discipline the legal operations AI lead is hired for.

A warning about the interview itself. Asking someone to describe how they would check a model's output selects for people who can describe it. If you want to know whether they do it, give them a short assignment with an assistant that will overreach, and watch.

Where Do You Find AI Policy Managers, and What Closes Them?

Look where the work is already public: comment dockets on federal AI rulemakings, witness lists from state legislature hearings on AI bills, NIST AI Risk Management Framework working groups, the IAPP's AI governance track and its certification cohorts, and Future of Privacy Forum or Brookings convenings. Adjacent titles worth approaching directly: privacy program manager, regulatory affairs manager, and district or agency technology director.

Comment dockets are the best of these and the least used. A person who filed a substantive, specific comment on a proposed rule has publicly demonstrated the exact deliverable you are hiring for, under their own name, with a date on it. Read three of their filings before the first call and you will know more than any screen would tell you.

Feeder organizations, in rough order of yield: state attorney general and agency policy shops, sector trade associations, the policy teams at cloud and model vendors (who often want out of advocacy and into operating), university research centers, and the growing pool of school district and state education agency staff who took the AI portfolio on when the mandate landed.

Closing them is not about money first. What this person wants, in order: a real mandate, meaning budget, a seat on the governance body, and the standing to stop a launch; direct access to the executive who decides, because a brief that travels through three layers arrives as a rumor; and permission to publish or speak, which is how they stay current and how they stay employable. The offer killers are consistent. Reporting three levels down kills it. A job that is only a document, with no inventory and no operational authority, kills it. An org where legal already owns the decision and the new role exists to write the announcement kills it fastest, because everyone in this field has watched a peer take that job.

AI Policy Manager Pay, Remote Norms, and the Offer Killers

No published salary series exists for this title as of mid-2026. It is too new and too unevenly named to appear in the standard wage surveys, and a point estimate for it is somebody's guess dressed as data. Price the base title the person is leaving instead: postings cluster around senior individual-contributor policy, regulatory affairs and privacy program bands, with public-sector pay set by the schedule rather than by the market.

That split is the important part. In the private sector this role competes with privacy program management and regulatory affairs for the same people, and an equity component or a director title is often what moves a candidate. In federal and state government, pay is fixed by grade, which is why agencies so frequently fill the function by promotion or by dual-hatting an existing manager rather than by opening a new line ¹. In K-12 and higher education, the AI portfolio is often added to a technology director's job with no new compensation at all, which is a retention problem you should assume rather than discover. If you are competing against a private employer for the same candidate, compete on mandate and access, because you will not win on cash.

Remote norms follow the room. The private-sector version is largely remote or hybrid, with travel that spikes during legislative sessions and around a rulemaking comment deadline. Government roles usually carry on-site days, sometimes a clearance, and a physical proximity to the capital that is not negotiable. District and campus roles are on-site, because half the work is hallway persuasion with principals and department chairs.

One budget line people forget: this person needs paid access to a legislative tracking service, or they will rebuild one by hand and spend a third of their week doing it. And when a brief turns into a commitment the organization can be held to, it goes to counsel before it goes out. The rules here are moving in several jurisdictions at once, so check with counsel on your own before treating any of this as legal guidance. The reporting and evidence habits that survive that review look a lot like the ones an analytics engineer builds for a data product: versioned, dated, and traceable back to a source.

Read the evidence >