AI governance framework template
See who owns each control, and what to build first.
Try the frameworkThe film is unavailable. You can read what it shows below.
What the film shows, in words
- See who owns each control, and what to build first.
- Eight controls. 2 in place: acceptable-use policy and staff training.
- The executive sponsor holds 5: two of them until you have: HR lead, Legal or compliance.
- 3 are high priority. Raise first: the AI inventory.
- With the inventory in place: 3 of 8. Next: human review rules.
- Reviewed every quarter. Yours to run.
The demo: the worked example, one input at a time
ExampleWorked example: a 120-person organisation piloting AI (illustrative).
- Controls in place
- 2/8
- High-priority controls to build
- 3
- High-risk uses
- 1
- Next control
- AI inventory
Eight slabs. Two are up.
Six lie flat in the tool’s build order, and a longer slab is a higher priority. Next to raise: AI inventory.
The executive sponsor holds 5 of 83 as owner, 2 until you have: HR lead, Legal or complianceIT or security lead 3
- 1AI inventoryHighExecutive sponsor
- 2Human review rulesHighExecutive sponsor
- 3Impact assessment for high-risk usesHighExecutive sponsoruntil you have: Legal or compliance
- 4Vendor due diligenceMediumIT or security lead
- 5Incident processMediumIT or security lead
- 6Monitoring of live systemsLowIT or security lead
2 in placeReviewed every quarter
- Acceptable-use policyIn placeExecutive sponsor
- Staff trainingIn placeExecutive sponsoruntil you have: HR lead
- standing: in place
- lying: to build, in the tool’s order
- longer: a higher priority
- aqua edge: next to raise
- dashed footing: a role not there yet
A working framework, not a legal certification or compliance opinion. Each step changes one input as an illustration; it is not advice to appoint anyone.
Now your organisation, and its eight controls.
Answer for your organisation today, not the plan. Set the facts, then raise the slabs that already exist.
- Controls in place
- 2/8
- High-priority controls to build
- 3
- High-risk uses
- 1
- Next control
- AI inventory
The executive sponsor holds 5 of 83 as owner, 2 until you have: HR lead, Legal or complianceIT or security lead 3
2 in placeReviewed every quarter
LivePress a lying slab to raise it, a standing one to lay it back, a footing to say whether you have that role. A raised slab means you say the control is in place, nothing more.
The executive sponsor holds 5 of 83 as owner, 2 until you have: HR lead, Legal or complianceIT or security lead 3
| Control | Owner | Status | Priority |
|---|---|---|---|
| AI inventory | Executive sponsor | To build | High |
| Acceptable-use policy | Executive sponsor | In place | – |
| Vendor due diligence | IT or security lead | To build | Medium |
| Human review rules | Executive sponsor | To build | High |
| Incident process | IT or security lead | To build | Medium |
| Staff training | Executive sponsor, until you have a role for this: HR lead | In place | – |
| Impact assessment for high-risk uses | Executive sponsor, until you have a role for this: Legal or compliance | To build | High |
| Monitoring of live systems | IT or security lead | To build | Low |
Critical points
- Gap: High-risk uses without impact assessment.Assess this use before launch or expansion.
- Check: No AI inventory yet.You cannot govern what you have not listed. The free AI inventory tool is a start.
AI governance framework (draft)
Accountability
- Leadership receives an AI report every quarter; add board oversight as use grows.
- The executive sponsor owns the framework and the inventory.
Controls to build, in order
- AI inventory: Executive sponsor.
- Human review rules: Executive sponsor.
- Impact assessment for high-risk uses: Executive sponsor, until you have a role for this: Legal or compliance.
- Vendor due diligence: IT or security lead.
- Incident process: IT or security lead.
- Monitoring of live systems: IT or security lead.
High-risk uses
- chat: impact assessment before launch, human review, monitoring.
Review rhythm
Review the inventory, incidents and controls every quarter. Update this framework when laws, tools or uses change.
Scale
At this size, name one owner per control and review them together at the governance meeting.
A working framework, not a legal certification or compliance opinion.
Starting governance framework
- Controls in place
- 2/8
- Next control
- AI inventory
- Review
- every quarter
Your draft framework
Starting governance framework, by email once delivery is connected.
- The table of owners, control by control
- The controls to build, in the tool’s order
- The review rhythm you chose
- A working framework, not a legal certification
Tool: AI governance framework Result: 2/8 controls · 3 high priority Named owners: 0 of 8. Gaps: 8 (AI inventory; Acceptable-use policy; Vendor due diligence; Human review rules; Incident process; Staff training; Impact assessment for high-risk uses; Monitoring of live systems). Escalation: not named (a gap) Delegation reference: none recorded (a gap) Review rhythm: every quarter (your choice) Authority: No job title authorises a payment or an approval by itself. This framework names who looks after each control. It gives no one a power to approve, sign, pay or procure. Those powers come only from your institution’s own approved delegation. Worked out for: Context not set · method 1.1 Request: please scope AI governance work or a fractional Chief AI Officer (SVC-014 / SVC-148).Send as a brief
How the framework is put together, and its limits.
The rules are published so you can check them. A working framework, not a legal certification or compliance opinion.
Method
- 01
Eight standard controls are assigned to the roles you have; missing roles fall to the executive sponsor until appointed.
- 02
Priority rises with your stage of AI use and with any high-risk uses you declare.
- 03
The framework links to the AI inventory, which should list every use it governs.
- 04
A control has an owner only when you name a person. A role, a function or a job title in that place is still a gap, and so is a blank, whether or not the control is in place.
- 05
Escalation and the delegation reference are your own words. Where you leave them blank the result says so and offers a route as proposed practice.
What it cannot tell you
- A starting framework; sector regulation may require more.
- It does not classify systems under the EU AI Act or any other law.
- Governance only works if the owner runs the reviews.
- It assigns no legal power. No job title in it authorises a payment or an approval; that comes only from your institution’s own approved delegation.
- No national law or guidance module has been reviewed for this tool. Name a country and the result says which coverage is missing.
Quality ruleNo automatic certification or legal-compliance score.
Two things in the picture are this page’s reading
- A lying slab’s length is the table’s priority in three steps: High, Medium, Low. Raised slabs share one height, because the tool gives no priority once a control is in place.
- “Holds” counts the rows of the table whose owner begins “Executive sponsor”, including those held until a role exists.
When the wall needs more than a template.
Governance only works if the owner runs the reviews. The tool names owners and an order of work; it cannot run the reviews.
- Service · 02 Management & institutional strengtheningAI-readiness & AI-governance assessment↗
- Service · 04 AI governance & assuranceFractional Chief AI Officer↗
-
Michael GagakumaTool owner · consultations from USD 90Book Michael -
Kenneth GagakumaTool owner · consultations from USD 90Book Kenneth