Is your org’s AI policy integrated into the IT security policy, or does it exist as its own separate policy?

There's a 3rd angle in here and that's data classification and handling, which is often a policy distinct from IT Security.

Data classification has an impact on AI as there are certain types of informaiton or data you don't want/can't have an AI accessing. 

To this end, the 3 policies should be seperate  but cross referencing each other where appropriate.