AI Governance Readiness Checklist

How to use it

• Tick a box only if you could show evidence for it today.
• Count your ticks at the end of each area and in total.
• Print the page (Ctrl+P or Cmd+P) to work through it with your team.

Ticks on this page are not saved or sent anywhere. For a scored result with domain breakdown and priorities, use the free AI Governance Assessment.

1. Inventory and ownership

Know what AI you have and who answers for it.

• We keep a list of every AI system and AI-enabled tool in use, including vendor AI features.
• We have looked for tools staff use without approval (shadow AI).
• Each AI system has a named business owner.
• The inventory records the purpose, data used and vendor for each system.
• The inventory is reviewed on a set schedule, not just once.

2. Accountability and oversight

Make someone responsible and give them authority.

• An executive owns AI governance, by name.
• A cross-functional group (security, legal, privacy, data, business) meets regularly.
• Leadership or the board receives AI risk reporting on a set schedule.
• Roles for approving, operating and reviewing AI systems are written down.
• Staff know who to ask before adopting a new AI tool.

3. Policy and approval

Write the rules and make them usable.

• A current AI acceptable use policy has been shared with all staff.
• A rule states what data may and may not be entered into AI tools.
• New AI tools go through a defined approval step before use.
• There is a process for requesting and recording exceptions.
• Policies are reviewed at least once a year.

4. Risk assessment

Match effort to impact.

• AI systems are classified into risk tiers.
• Higher-risk systems get a documented risk assessment before launch.
• Assessments cover data sensitivity, decision impact, bias and misuse.
• Risks are tracked in the same register as other enterprise risks.
• Assessments are repeated when a system changes materially.

5. Vendors and third parties

Hold suppliers to the same standard.

• Vendor reviews include questions on AI use and data handling.
• We know whether each vendor uses our data to train models.
• Contracts address AI-related data use, incidents and audit rights.
• We track AI features that vendors add to products we already use.
• High-risk AI vendors are reviewed on a schedule.

6. Security, monitoring and evidence

Protect it, watch it and prove it.

• Access to AI tools and their data is controlled and logged.
• We test AI systems for misuse such as prompt injection.
• Limits exist on what AI agents are allowed to do on their own.
• Incident response covers AI failures and data leakage.
• We keep evidence (approvals, assessments, reviews) that an auditor or customer could review.

Reading your score

• 0 to 10 ticks: early stage. Start with the inventory, an owner and a short acceptable use policy.
• 11 to 20 ticks: developing. The basics exist. Focus on risk tiers, vendor review and evidence.
• 21 to 30 ticks: established. Test the evidence, close the remaining gaps and consider certification such as ISO/IEC 42001.

These ranges are a rule of thumb for self-assessment. They are not a certification or a regulatory determination, and this checklist is general information, not legal advice.