I have but at least for the technical domains I have overseen, policy was not dictated by legal by cocreated based on my input, except in cases where we were bound by law specifically (eg reporting timelines to gov agencies).

HR is a bit different and strange to bring up, especially considering I used enterprise architect as an example. AI safety would presumably be not cross-cutting for all domains at a company (does the janitorial staff need to know about it? no but they do need sexual harassment training), but be more like the enterprise architects designing in the sky and handing it down for implementation.