Can your organization answer these 25 AI governance questions?
Use this with leadership, IT, security, privacy, HR, procurement, and business owners. Mark Yes, No, or Needs review, then assign an owner for every unresolved item.
Important: This educational checklist is not legal advice, does not determine whether a law applies, and does not establish compliance. AI requirements change rapidly. Confirm applicable duties with qualified counsel and other appropriate specialists.
- We have an executive sponsor and accountable owner for AI governance.Yes □ No □ Review □
- We have defined who may approve, reject, pause, or retire an AI use.Yes □ No □ Review □
- We have documented prohibited uses, risk tolerance, and exception handling.Yes □ No □ Review □
- We maintain an inventory of purchased, developed, embedded, and employee-selected AI.Yes □ No □ Review □
- Our inventory includes browser tools, personal accounts, extensions, copilots, APIs, agents, and connectors.Yes □ No □ Review □
- Every material AI use has a business owner, purpose, affected population, and lifecycle status.Yes □ No □ Review □
- We know what data each AI system can receive, retrieve, infer, generate, or expose.Yes □ No □ Review □
- We have rules for prompts, uploads, outputs, history, memory, feedback, logs, retention, and deletion.Yes □ No □ Review □
- Credentials, secrets, and restricted data are blocked from unapproved general-purpose AI.Yes □ No □ Review □
- We have confirmed contractual and organizational authority to use customer, employee, and proprietary data.Yes □ No □ Review □
- We screen AI uses for privacy, employment, biometric, consumer, civil-rights, accessibility, and sector requirements.Yes □ No □ Review □
- We separately track internal risk tier, data classification, and legal classification.Yes □ No □ Review □
- We review customer contracts, supplier terms, and insurance conditions for AI restrictions.Yes □ No □ Review □
- We review vendor training use, retention, deletion, subprocessors, data locations, and incident terms.Yes □ No □ Review □
- AI accounts use appropriate identity controls, access roles, logs, offboarding, and least-privilege permissions.Yes □ No □ Review □
- Each material use has a documented risk assessment and treatment decision.Yes □ No □ Review □
- We have defined hard-stop conditions that prevent deployment or require suspension.Yes □ No □ Review □
- Human reviewers have enough information, time, competence, and authority to reject AI output.Yes □ No □ Review □
- People affected by higher-impact uses have appropriate correction, escalation, or appeal routes.Yes □ No □ Review □
- We test material systems for performance, unsupported output, privacy, security, misuse, and relevant outcome differences.Yes □ No □ Review □
- Every deployment has a recorded approval, approved boundaries, known limitations, and next review date.Yes □ No □ Review □
- We monitor new tools, data interactions, connectors, errors, complaints, overrides, and vendor changes.Yes □ No □ Review □
- AI incidents are integrated with privacy, security, legal, HR, and business-continuity response.Yes □ No □ Review □
- Personnel receive baseline AI literacy and role-based training where appropriate.Yes □ No □ Review □
- We periodically reassess, improve, retire unused systems, revoke access, and preserve decision evidence.Yes □ No □ Review □
First three actions
1. ____________________________________________________________________________________
2. ____________________________________________________________________________________
3. ____________________________________________________________________________________
