Answer
Is an AI policy enough, or do you need something else?
A policy describes what people should do. A workflow is what they actually do. Both are useful and they are not substitutes: a firm can have a well-written policy, follow it in good faith, and still be unable to say what happened on any particular job.
Policies are cheap and genuinely useful
Templates are widely available, several professional bodies give members one for nothing, and having one is better than not having one. This is not an argument against writing a policy.
It sets an expectation, which is the thing a policy is for.
What a policy cannot do
It cannot perform a step. If the policy says sensitive details should be removed before use, somebody still has to remove them, every time, including when they are busy.
It cannot produce a record. A policy is a statement of intent; it does not leave a trace of any individual job having followed it.
It cannot decide who checks. It can say review should happen, but it cannot stop the draft and put it in front of a particular person.
The useful way to hold the two together
The policy says what the firm intends. The workflow is where the intent is carried out on a particular job, and the record is what is left behind afterwards.
If you already have the policy, the gap is not another document. It is one job, defined, with the steps built in.
FlowClave is a software workflow. This is not legal, privacy or compliance advice, and it does not make a firm compliant with anything. Your firm remains responsible for its own obligations.