AI Governance Starter Kit

Build a practical AI governance program before AI usage gets ahead of your organization, starting this afternoon.

The Acceptable Use Quick Guide tells employees what they can do, what needs approval and what they must never do, with a clear data rules table covering public tools, approved enterprise tools and internal AI. The registration form captures every new AI use. The inventory and quick risk assessment give you a list of what you have and a High, Medium or Low rating from eight yes or no questions. The vendor questions surface the four things that matter most: training on your data, retention, deletion and which models power the service.

Built around the NIST AI Risk Management Framework and informed by ISO/IEC 42001 AI management-system concepts.

What is included

1. AI Acceptable Use Quick Guide

2. AI Use Case Registration Form

3. AI Inventory (Excel)

4. AI Risk Quick Assessment (Excel)

5. AI Vendor Questions

6. AI Incident Quick Report

7. AI Review Checklist

8. AI Approval Checklist

9. Starter Kit Guide (PDF)

Who it is for

IT directors, security managers and engineers, compliance and risk managers, CIOs, COOs, AI program leaders and business owners at organizations of roughly 25 to 500 people whose employees are adopting AI faster than the organization is building the management system around it.

Formats

6 Word documents, Excel inventory and risk scoring, PDF guide.

License

License. Your purchase grants one organization a perpetual, non-exclusive license to use, copy, and modify these materials for its own internal security program, including sharing completed questionnaires and contract exhibits with its own vendors. You may not resell, sublicense, or redistribute the templates themselves, in original or modified form, as a product. Consultants and managed service providers who want to use the materials across multiple client organizations need a practitioner license; contact cyberauctoritas.com.

Disclaimer

This material is provided for general information and internal program building. It is not legal advice and does not certify compliance with any law, regulation, or framework. Contract language must be reviewed by qualified counsel before use. Adapt every document to your organization, your risk tolerance, and your obligations.