AI Governance in Practice — Part 1: Inventory, Risk Tiering, Approvals & Policy — 42 Templates, Checklists & Worksheets for the AI Inventory, Risk Tiering, Approval Lanes, Policy Library & Documentation Chain

Every company has two AI governance systems: the official one in policy, and the real one in a spreadsheet. 42 production templates, checklists & worksheets distilled from Chapters 1–6 of AI Governance in Practice: the register schema and four-channel discovery, the twenty-minute intake and shadow-AI amnesty, the four-dimension tiering rubric with its overrides and calibration, lanes with clocks (same day / 5 days / 15 days), the four-shelf policy library, and the data sheet / model card / system card chain — ending in the book's 40-line Part 1 gate. PDF + Markdown source.

Forty-one rows in a spreadsheet. That is the real register.

Ask a governance lead how an AI system gets approved and you will be shown two artefacts: the policy — twelve pages, legally careful, approved by a committee — and then, if your guide trusts you, the spreadsheet: forty-one rows, colour-coded by a system only its owner understands, last updated from memory on a Friday. The spreadsheet is the register. The chat thread linked in row twelve is where an approval actually happened. AI Governance in Practice — Part 1 is the machinery that retires the spreadsheet: 42 copy-paste templates, checklists, and worksheets distilled from Chapters 1–6 of the dedicated governance book — diagnose the two-documents problem, build the one door in (a register that tells the truth and an intake a team can finish in twenty minutes), sort before you judge with a one-page tiering rubric, run approvals as lanes with published clocks, write a policy library people can actually follow, and document every system in a chain of cards that earns its keep.

Every item carries the book's tested positions built in: governance defined as decision machinery and graded by five unkind tests (the one-minute inventory, the five-minute approval, the clock, the expiry, the incident drill), a register schema in which every field is consumed by a later mechanism — with the book's worked entry, in which the conditions field itself detects the day someone proposes auto-send as a "configuration tweak" — a tiering rubric scored on impact, autonomy, data, and reach where the tier is the maximum, never the average, corrected by four written overrides, lanes that decide the same day, in five business days, and in fifteen, with exceptions that expire automatically in ninety days because an exception that needs remembering is permanent, reviewer capacity done as honest arithmetic (the book's worked example: 25 submissions a month is roughly 50 skilled hours), policies drafted with thresholds instead of adjectives and a route beside every prohibition, and system cards in which every capability claim is "shown to" with evidence — or marked unverified. Where the book gives an example — its lane clocks, its rubric anchors, its Northgate diagnosis (a register holding 41% of a 34-system estate) and its month-twelve repair (61 systems, 97% coverage, a 4.2-day median) — the template labels it as the book's example for you to refill with your own measurements. Bracketed fields are yours to fill; nothing here invents a figure for your organisation. The book's companies and systems — Northgate Retail Group, the support drafting assistant AI-0147 — are fictional composites, labeled fictional in the book itself. This pack is governance machinery, exactly as the book frames it: it is not legal advice, and it certifies no compliance with any regulation or standard.

What's inside — 42 templates, checklists & worksheets in 7 sections

1. The Two Documents — Governance as Decision Machinery (6) — Two-Documents Diagnosis & Real-Register Finder · Four-Layer Operating Model Map · Five Machinery Tests Scorecard · Queue & Rubber-Stamp Failure-Mode Review Sheet · Attention-Economics & Ungoverned-AI Cost-Ledger Sheet · Worked Diagnosis, Month-Twelve Target & Maturity Ladder Sheet

2. One Door In — Register, Intake & Discovery (7) — Register Schema Template — Five Field Groups · Four-Channel Discovery Routine · Twenty-Minute Intake Form — Three Parts & the Receipt · Shadow-AI Amnesty Plan · Lifecycle, Material-Change & Retirement Sheet · Register Quality — Completeness, Accuracy & Staleness Checks · Three Arrivals, Federation & Intake Clinic Sheet

3. Sort Before You Judge — Risk Tiering (6) — Four-Dimension Tiering Rubric — the One Page · Four Override Rules Sheet · Calibration Workshop Kit · Worked Scoring — Three Systems, Three Arguments · Rubric Health — Inflation, Gaming, Drift & Tier Costs · Revision Diary, Retroactive Sweep & the EU AI Act Honesty Note

4. Lanes With Clocks — Approval Workflows (7) — Three-Lane Design Sheet — Tiers, Deciders, Clocks · Pattern Library Specification · Conditions Craft Sheet — Four Families · Exceptions Register — Loans, Not Gifts · Capacity Arithmetic & Reviewer Rota Sheet · Appeal Path, Reviewer's Craft & Surge Protocol Sheet · Lane Ledger, Conditions Clinic & Reviewer Rotation Sheet

5. Write Rules People Can Follow — The Policy Library (6) — Four-Shelf Library Stack Map · Five Drafting Rules & Policy-Page Anatomy Sheet · Core Policies I — Acceptable Use & Data for AI Outlines · Core Policies II — Vendor & Model + Lifecycle Outlines · Versioning, Acknowledgement, Grey Shelf & Pruning Sheet · Rollout, Enforcement Ladder, Conflict Protocol & Reading Tests Sheet

6. Cards That Earn Their Keep — Data, Model & System Cards (7) — Documentation Chain & Burden-by-Tier Sheet · Data Sheet Template — Provenance & Prohibited Uses · Model Card Template — Claims With Evidence · System Card Template — the Approval's Working Document · Complete System Card — AI-0147, Filled In · Bought-System Cards, Review-Meeting Protocol & the Card That Stopped a Launch · Keeping Cards Alive — Triggers, Sampling, Theatre & the Card Clinic

7. Startup, Consistency & the Part 1 Gate (3) — First-Thirty-Days Startup Plan & Two-Week Inventory Sprint · Register–Card–Lane Consistency Audit Sheet · Part 1 Governance Gate — Chapters 1–6 Sign-Off — the book's six chapter checklists consolidated into one evidence-backed gate (40 lines)

Who this is for

Chief AI officers and the executives who appoint them, governance, risk, and compliance leaders translating intention into process, review board members who want evidence in front of them instead of slide theatre, and platform or product leads who file intake and live with the clocks. The source book assumes an organisation large enough to have the problem — dozens of AI use cases, several business units, at least one regulator or enterprise customer asking questions. If nobody in your organisation can produce the list of production AI systems in one minute — in one sitting — start at Template 7.

What this pack is not

Not Part 2. Decision rights, the CAIO and board design, audit trails and decision records, the framework crosswalks (EU AI Act / NIST AI RMF / ISO/IEC 42001), metrics and the board report, incident governance, and scaling and federation are the book's Chapters 7–12 — and Appendices A (Master Checklist), B (Quick Reference), and C (Decision Record and Board Report templates) travel with them. They live in the Part 2 companion pack; nothing here restates them, and this pack is complete and useful without them. Where Chapters 1–6 point forward to that material, this pack carries the pointer only.

Not legal advice, and not a compliance certification. The source book's own position, carried in full: governance frameworks and regulatory timelines change, and obligations must be verified against the authoritative sources and qualified legal counsel before any compliance decision. This pack builds the machinery — inventory, tiering, approvals, policy, documentation. It does not map that machinery onto any regulation, and passing its Part 1 gate certifies only that the machinery exists and operates. Template 19 states the book's own warning plainly: an internal tier is a management instrument, never a legal conclusion.

Not the adoption program. The companion Enterprise AI Adoption Checklist pack runs the enterprise adoption sequence — readiness, business case, pilots, hardening, rollout — and touches governance only as setup rows inside that program. This pack is the dedicated governance book's machinery in depth: register, rubric, lanes, library, cards. The two packs share no checklist.

Not the cross-book security slice. The companion AI Security Templates & Checklists pack holds the MCP-and-enterprise-agents security artifacts, including its governance committee charter and regulatory compliance map. This pack ships no committee charter (decision rights are Part 2) and no compliance map — deliberately, and for the same reason.

Not agent security. The companion Securing AI Agents — Part 1 pack registers agents and their credentials, permissions, sandboxes, and tool-call gates. This pack registers AI use cases and their governance state — tier, approval, conditions, review date — for portfolio-level decisions. Different register, different question.

No platform or tooling. The register entry, intake form, and card shapes are simplified, structurally honest templates. No governance platform, workflow engine, or dashboard ships here — the book's own position is that a well-kept register in a workflow tool beats a neglected one in an expensive platform.

Companion products

The Enterprise AI Adoption Checklist pack is the adoption-program companion — the rollout sequence this pack's governance machinery serves. The AI Security Templates & Checklists pack is the cross-book security companion. Securing AI Agents — Part 1 is the agent-security companion. AI Governance in Practice — Part 2: Decision Rights, Audit Trails, Framework Crosswalks & Metrics is this pack's sibling, built from Chapters 7–12 of the same book plus Appendices A, B, and C: a companion for when you are ready for the decision-rights, evidence, and crosswalk half — never a requirement for this pack to work. This pack stands alone.

Note: the $99 Architecture Templates Bundle currently contains Products #1–#3 only. This pack launches standalone; no bundle inclusion is promised for this product.

Built by the author of AI Governance in Practice: Policies, Approvals, and Audits That Teams Actually Follow, from the governance discipline behind production enterprise AI systems.

About the author

Naveen Kumar Josyula is the author of 35 AI books on Amazon KDP and the CEO and founder of AISoltrics Technologies Inc. He is the author of the source book, AI Governance in Practice: Policies, Approvals, and Audits That Teams Actually Follow, from which every template in this pack is distilled.

Support promise

If anything in this file is wrong or unclear, email support@aisoltrics.com before you judge it — we fix verified issues within one business day and send you the corrected file free. (You can also reach the founder's office at aadhya@aisoltrics.com.) Updates to this product are free to past buyers via your Payhip library. Sold by AISoltrics Technologies Inc.