Free Resources Checklist

AI Governance Checklist

Practical controls for organizations already using AI, written by a principal who led AI as Chief AI Officer at a regulated lender.

Tick items as you go. Use your browser's print option to save it as a PDF.

01Inventory

You cannot govern what you cannot see.

A list of where AI is used today, including tools staff adopted on their own
Vendors whose products now include AI features, and what those features do with your data
An owner for each AI use case in production

Clear rules people can actually follow.

An acceptable use policy that says which tools are approved and what data may go into them
A simple way for staff to request a new AI tool or use case
Training so people know the policy exists and why it matters

Someone accountable, and a board that is kept informed.

What goes in, what comes out, and who can use it.

Contracts that state whether vendors may train on your data, and how long they keep it
Controls that keep confidential, customer, and regulated data out of unapproved tools
Data quality checks for any model that informs decisions

Matching the controls to the stakes.

Use cases rated by risk, with stricter controls for decisions about customers, credit, hiring, or safety
Human review for high-impact decisions
Explainability and bias testing built in from the start where rules require it

AI adds new ways to leak data and be manipulated.

Protections against prompt injection and data leakage in AI tools and integrations
Access controls and logging for AI systems, the same as any other critical system
AI scenarios included in incident response and tabletop exercises

AI should earn its keep.

If several of these are unchecked, a short baseline will show you which gaps matter and what to do first.