AI Governance in Practice — Part 2: Decision Rights, Audit Trails, Framework Crosswalks & Metrics — 42 Templates, Checklists & Worksheets for Decision Rights, Audit Trails, the EU AI Act / NIST AI RMF / ISO 42001 Crosswalks, Metrics, Incident Governance &

Who can halt your customer-facing AI at 2 a.m. — and can you prove, in five minutes, who approved it and on what evidence? 42 production templates, checklists & worksheets distilled from Chapters 7–12 and Appendices A–C of AI Governance in Practice: the one-page decision-rights map and CAIO charter, the decision record and append-only evidence store with its sampling regimes and five-minute drill, the book's own EU AI Act / NIST AI RMF / ISO/IEC 42001 crosswalks carried exactly as printed, the six core metrics and two-page board report, the incident decision cell with pre-delegated halt authority, federated scale — plus the book's Master Checklist, tier/lane quick reference, and verbatim decision-record and board-report templates. Standalone: complete and useful without Part 1. PDF + Markdown source.

The approval happened. Can you prove it?

Ask who approved a production AI system — who decided, on what evidence, under which version of the rules, with what conditions — and most organisations start digging: chat threads, meeting minutes, someone's memory. That digging is archaeology, and it is what auditors, regulators, and courts find when the machinery has no memory. AI Governance in Practice — Part 2 is the decision-and-evidence half of the discipline: 42 copy-paste templates, checklists, and worksheets distilled from Chapters 7–12 and Appendices A, B, and C of the dedicated governance book — allocate decision rights on one page so anyone can answer "who decides this?" in one step, build audit trails that generate themselves as decision records in an append-only evidence store, map the one system three times onto the EU AI Act, NIST AI RMF, and ISO/IEC 42001, run the program on six measured numbers and a two-page board report, govern the incident itself in a decision cell whose halt authority was written in peacetime, and federate the whole design across business units without forking its standards.

Every item carries the book's tested positions built in: a decision-rights table in which teams decide inside patterns, the governance office decides the standard lane, the board decides the constitutional questions, and one named executive owns appetite, crisis authority, and the external account — with escalation moving up one level at a time and delegation moving down only on evidence; a decision record with a fixed seven-field anatomy, written at decision time by the deciding workflow, under the book's one transforming rule — no decision is communicated before its record exists; sampling regimes sized for meaning (the book's stratified monthly sample of 12–15 systems for a portfolio of a few hundred) and a monthly, unannounced five-minute reconstruction drill whose pass rate is the program's core honesty metric; the six core metrics with discovery-based denominators and honest failure states, read in bad quarters as a system rather than as tiles — the book's worked bad quarter (coverage 94%, drill pass rate 82%, two third-renewal exceptions traced to one policy bug) is carried in full; severity criteria written by consequence, a decision cell drilled twice a year, notification run as three separate recorded decisions, and the close-out rule that every serious incident changes the machinery or writes down why it should not; and a twelve-month roadmap whose quarterly exits are testable properties — drill pass rate at least 90%, card accuracy at least 95% on sample — never campaigns. The appendices ship whole: the book's 27-line Master Checklist, its tier/lane quick reference, its mechanism crosswalk, and its verbatim decision-record example (DEC-2026-1187) and board-report shape. Where the book gives an example — its clocks, its sample sizes, its composite incident night (41 flagged conversations, a halt decided at 23:05, a decision log filed by 10:00 the next morning) — the template labels it as the book's example for you to refill with your own measurements. Bracketed fields are yours to fill; nothing here invents a figure for your organisation. The book's systems — the support drafting assistant AI-0147 and its larger sibling, the recruitment screening assistant — are fictional composites, labeled fictional in the book itself. This pack is governance machinery, exactly as the book frames it: it is not legal advice, and it certifies no compliance with any regulation or standard.

What's inside — 42 templates, checklists & worksheets in 8 sections

1. One Page of Decision Rights — the CAIO, the Board & Everyone Else (6) — Decision-Rights Map — One Page · CAIO Charter — a Role Defined by Its Decisions · Board Design Sheet — Against the Bottleneck & the Rubber Stamp · Three Lines Adapted & Anti-Bureaucracy Sheet · Boundary Disputes, Continuity & Authority Card Sheet · Office Staffing, Meeting Architecture, Board Pack & Dissent Channel Sheet

2. Evidence, Not Archaeology — Audit Trails That Generate Themselves (6) — Decision Record Template — the Atom of Evidence · Retention Schedule & Evidence Store Design Sheet · Sampling Regimes & Five-Minute Drill Sheet · Mock Audit, Underlying Logs & Hostile-Reader Sheet · Deletion Ceremony, Completeness Proof & M&A Evidence Sheet · Records-Writing Curriculum Sheet

3. One System, Three Maps — Framework Crosswalks & the Standing Duty (6) — Three Principles & Role-Determination Sheet · EU AI Act Categories & Deployer Duty Set Sheet · NIST AI RMF & ISO/IEC 42001 Mapping Sheets · Crosswalk Table — Obligation → Mechanism → Evidence · Worked Mapping — One System Through All Three Instruments — plus the Provider Boundary · Questionnaire File, Conformity Sequencing, Sectoral Overlays & the Standing Duty

4. Numbers, Not Adjectives — Metrics & the Board Conversation (5) — Six Core Metrics Definitions Sheet · Quarterly Board Report — Two Pages That Matter — plus the Dashboard · Board Conversation — Five Questions — plus Reading a Bad Quarter · Metric Pathologies, Targets & Definitions Freeze Sheet · Monthly Rhythm, Annual Machinery Review, Cascade & Survey Sheet

5. When the AI System Is the Incident — Governance in a Crisis (6) — Severity Criteria Sheet — Three Levels, Written in Advance · Decision Cell Charter & Pre-Delegated Authority Sheet · Notification Decisions Sheet — Three Recorded Decisions, External Clocks · Worked Night in the Cell — the Support Assistant Incident, as the Book Prints It · Close-Out Rule, Long Tail & Repeat-Incident Sheet · Holding Statements, Stand-Down & Tabletop Library Sheet

6. Governance That Scales — Federating Without Losing the Plot (6) — Centre/Unit Allocation Sheet · Champion Network Charter Sheet · Shared Platform Specification Sheet · Governance Debt Ledger & Burn-Down Sheet · Twelve-Month Roadmap — Four Quarters With Exit Criteria · Federation Failure Modes, Program Charter, Year-Two, Handover & Small-Company Subset Sheet

7. Quick Reference & Verbatim Templates — Appendices A, B & C (4) — Master Checklist — Appendix A, in Full · Tier/Lane Quick Reference — Appendix B · Mechanism Crosswalk Quick View — Appendix B · Decision Record & Board Report Templates — Appendix C, Verbatim

8. Consistency, Cadences & the Part 2 Gate (3) — Part 2 Consistency Audit Sheet · Part 2 Governance Gate — Chapters 7–12 Sign-Off — the book's six chapter checklists for Chapters 7–12 consolidated into one evidence-backed gate (40 lines) · Standing-Duty Calendar Sheet

Who this is for

Chief AI officers and the accountable executives who own AI risk appetite, governance office heads and review board members who need their decisions to survive an auditor's sample, audit and assurance leaders who draw samples for a living, and program leads federating governance across business units. It assumes your organisation already runs intake in some working form — a register, a tiering habit, an approval route, formal or not — and needs the half that most programs lack: named deciders, self-generating evidence, a maintained map to the outside world's obligations, honest numbers, a rehearsed room for the bad day, and a design that scales. If your board pack is assembled in a panic each quarter, start at Template 20.

What this pack is not

Not Part 1 — and Part 1 is not required. The register schema, twenty-minute intake, tiering rubric body, lane design, policy library, and card templates are the book's Chapters 1–6; they live in the Part 1 companion pack, and nothing here restates them. This pack stands alone: it builds decision rights, evidence, crosswalks, metrics, incident governance, and scale on whatever intake machinery you already run. The one appendix artefact that summarises both halves — the book's own Master Checklist and its tier/lane quick reference (Appendices A and B) — travels with this pack, exactly as the book assigns it, and is carried whole.

Not legal advice, and not a compliance certification. The framework crosswalks in this pack (Templates 16 and 38) are the source book's own mappings between its governance machinery and the EU AI Act, NIST AI RMF, and ISO/IEC 42001, carried exactly as the book prints them and labelled as the book's. The source book's own position, carried in full: obligations and timelines change, and they must be verified against the authoritative sources and qualified legal counsel before any compliance decision. A framework mapping is not compliance; ISO/IEC 42001 certification attests that a management system exists and operates — never that a system is safe or lawful — and passing this pack's Part 2 gate certifies only that the decision-and-evidence machinery exists and operates.

Not incident forensics. Template set 5 governs the decisions around an AI incident — severity, halt authority, notification, close-out. Technical containment, forensics, and the security runbooks are the security program's territory, and the dedicated AI Incident Response packs cover the first-response and recovery craft. This pack's cell decides; it does not do the forensics.

Not the adoption program. The companion Enterprise AI Adoption Checklist pack runs the enterprise adoption sequence — readiness, business case, pilots, hardening, rollout. This pack is the dedicated governance book's decision-and-evidence machinery in depth. The two packs share no checklist.

Not the cross-book security slice. The companion AI Security Templates & Checklists pack holds the MCP-and-enterprise-agents security artifacts, including its governance committee charter and regulatory compliance map. This pack's decision-rights map, board design, and framework crosswalks come from the dedicated governance book — different source, different artifacts, no shared item.

No platform or tooling. The decision record, evidence store, and dashboard shapes are simplified, structurally honest templates specifying those components. No governance platform, workflow engine, evidence store, or dashboard software ships here.

Companion products

AI Governance in Practice — Part 1: Inventory, Risk Tiering, Approvals & Policy is this pack's sibling, built from Chapters 1–6 of the same book: the intake half — register, rubric, lanes, library, cards — for when you want the book's full depth on that half. It is a companion, never a requirement: this pack is complete and useful without it, and Part 1 is complete without this pack. The Enterprise AI Adoption Checklist pack is the adoption-program companion. The AI Security Templates & Checklists pack is the cross-book security companion. The AI Incident Response packs are the incident-craft companions to Section 5's decision governance.

Note: the $99 Architecture Templates Bundle currently contains Products #1–#3 only. This pack launches standalone; no bundle inclusion is promised for this product.

Built by the author of AI Governance in Practice: Policies, Approvals, and Audits That Teams Actually Follow, from the governance discipline behind production enterprise AI systems.

About the author

Naveen Kumar Josyula is the author of 35 AI books on Amazon KDP and the CEO and founder of AISoltrics Technologies Inc. He is the author of the source book, AI Governance in Practice: Policies, Approvals, and Audits That Teams Actually Follow, from which every template in this pack is distilled.

Support promise

If anything in this file is wrong or unclear, email support@aisoltrics.com before you judge it — we fix verified issues within one business day and send you the corrected file free. (You can also reach the founder's office at aadhya@aisoltrics.com.) Updates to this product are free to past buyers via your Payhip library. Sold by AISoltrics Technologies Inc.