Guide · 9 min read
AI Governance Checklist for Business Systems
AI governance does not need to start with a policy document. For most businesses it starts with a short set of concrete controls applied to each AI system, then grows as usage grows.
Use this checklist for each AI system you run or plan to build. It is a starting point, not legal advice; regulated industries will have additional requirements.
Ownership and purpose
- Each AI system has a named business owner and technical owner
- Its purpose and scope are written down
- Decisions it may make versus recommend are explicit
- Users know when they are interacting with AI
Data handling
- Data sent to models is limited to what each task needs
- Sensitive data is identified and redacted where possible
- Model provider data-retention and training settings are reviewed
- Data residency requirements are known and met
Access and actions
- Each agent has its own identity and least-privilege permissions
- Credentials are stored in a vault and rotated
- Tools are allow-listed at the operation level
- Consequential actions require human approval
Quality and evaluation
- An evaluation set built from real cases exists
- It runs before every change to prompts, models, or tools
- Known failure modes are documented
- Review feedback is captured and used
Monitoring and incidents
- Every decision and action is logged
- Quality, cost, and error metrics are monitored with alerts
- Any agent can be paused immediately
- There is a documented process for investigating and reverting incidents
Vendors and change
- Model and tool vendors are reviewed for security and data handling
- Model version changes are tested before adoption
- Changes to the system are reviewed and recorded
- Governance is revisited as the system's scope grows