AI Governance Checklist
About this resource
A policy can be complete and governance can still be absent. The distinction is whether the things in the document are true in practice: whether a named person actually owns it, whether staff can state the data rule without looking it up, whether the review point is observed, and whether anybody has ever used the reporting route.
This checklist tests that. It is deliberately written as observable conditions rather than as intentions, so each item can be verified rather than believed. Where the Anatomy of a Practical AI Use Policy audits the document, this audits the reality, and the two frequently disagree. Run it quarterly and the drift becomes visible while it is still small.
Every item is written as something you can check rather than something you can believe. A governance item you cannot verify is an intention.
How to use it
Run it quarterly, and score it on what an employee could demonstrate rather than on what the policy says. The single most informative item is whether anyone has used the reporting route: a route nobody has used in a year is not evidence of a flawless organization, it is evidence that people do not believe reporting is safe.
Inside the download
Whether a named person owns governance, or whether everyone assumes somebody else does.
Whether it exists, and whether it has changed since it was written.
Whether people can state the data rule without looking it up.
Whether the review date was observed or quietly passed.
Common questions
Test observable conditions rather than reading the policy. Can a named person be identified as the owner? Can staff state the data rule without looking it up? Has the approved tool list changed since it was written? Was the review date observed? Has anyone used the reporting route? Governance that passes those is real.
A light quarterly check and a substantive annual review. The quarterly pass catches drift while it is small, particularly on the approved tool list and the reporting route. The annual review is where scope, boundaries, and ownership get genuinely reconsidered.
Almost never that no mistakes have occurred. It usually means people do not believe reporting is safe, or do not know where to report. Both are governance failures, and both are invisible until an unreported mistake becomes an incident.
Free. No email list, no follow-up sequence.
More from the resource library, chosen because they pair well with this one.
Map your whole governance position on one landscape page in a single working session.
Twelve components, what each one has to accomplish, and the common weakness that makes each one fail.
Ten questions for directors approving something they cannot evaluate, with what a good answer sounds like and what should concern you.
Tell us a little about yourself and this document is yours. We don't have an email list. We collect this so we know who's finding our resources useful, and that's it.
You're downloading
this document
Your information is kept confidential and never shared with anyone.
