AI Governance Starter Kit

Start with one real use

AI governance should help a team make an everyday decision: whether a proposed use can proceed, what it may do, and who must review it. Begin with one workflow rather than a policy covering every possible technology. Bring its business owner, someone who performs the work, and the relevant technology or specialist colleagues into the discussion.

This starter kit produces an intake record and a review-and-ownership plan. It does not approve an AI use. Your organisation decides which people can authorise an activity and which specialist reviews are required. Record a missing answer as unknown, name an owner to investigate, and keep the proposed use within its existing permissions while questions remain.

Describe the boundary before judging the tool

Complete the AI-use intake worksheet in order. Explain the business purpose, current process, proposed users, input sources, output and any action the system could take. Distinguish drafting a suggested response from sending it, and retrieving an approved document from accessing a whole repository. These differences change the questions the team needs to resolve.

Identify who could be affected by a wrong answer or an inappropriate action, including people outside the immediate user group. Describe exclusions explicitly. If the use could affect a person's eligibility, employment, access to a service, or another consequential decision, ask the appropriate specialist owners to determine the required assessment and decision route. A workshop or prompt cannot provide that determination.

Add evidence references rather than copying sensitive records into the worksheet. A document identifier, access-controlled location and review date can show where an authorised reviewer should look. Describe the approved information category in planning copies; do not assume that information available to an employee is permitted in every AI tool.

Make review responsibilities specific

Use the second worksheet to connect each unresolved question with its responsible function, required evidence, proposed action and human decision owner. The business owner confirms the intended workflow. Technology colleagues establish what the system actually does. Legal, privacy, security and risk owners decide the questions within their remits, using the organisation's existing processes.

Ask each owner what would allow them to make the next decision. A vendor statement may need a contract review, a configuration check or a practical test. Keep a supplier's claim separate from verified evidence. If a review is incomplete, record the limitation and the decision it prevents instead of converting an empty field into a favourable result.

Define what human oversight will involve

“A person checks the answer” leaves the working arrangement unclear. Specify who reviews which output, what they compare it with, when they must intervene and whether they can reject it. Confirm that the reviewer has time, access and the authority to perform those checks. Plan how disagreement, uncertainty and missing source information will be handled.

Agree who can pause use and how work continues manually. Record the route for reporting an issue, the information to preserve through approved channels and who decides whether the use can restart. Avoid putting confidential incident detail into a broadly shared planning sheet; use a reference to the existing restricted incident record.

Fictional example: an internal knowledge assistant

A fictional IT service team proposes an assistant that drafts answers from a selected set of approved internal support articles. It will not access employee case histories, change permissions, close tickets or send replies. Service advisers remain responsible for the response and use the existing support route when an article is missing or contradictory.

The fictional intake records that source permissions still need confirmation. The review plan assigns that question to the information owner and the technical access check to the systems owner. It does not mark the use ready because a demonstration looked convincing. The completed example files show how the same uncertainty carries into the decision record.

In the proposed oversight arrangement, an adviser checks the draft against its cited support article before responding. A missing citation or contradictory instruction returns the task to manual handling. An unsupported suggestion about account access is referred to the service lead. These are fictional planning conditions, not evidence of a completed client deployment.

Keep the decision current

Before the next step, agree the allowed scope, open actions, decision owner and review point. Keep evidence of the owner's actual decision with the record. Revisit it when the model or provider changes, new information sources are added, more users receive access, or the tool is allowed to take a different action. A past decision may no longer cover the changed use.

Use the five prompts to check the draft intake, prepare owner questions, describe oversight, challenge supplier evidence and summarise a review. Read their common instructions first. Supply only material approved for the chosen AI tool, treat suggestions as drafts and have the named people confirm the result.

Use the files together

Open the guide in a browser and print it if useful. Import the blank CSV files as UTF-8 text into your spreadsheet application, save working copies and compare them with the fictional examples. The worksheets contain no automatic scoring or formulas. They leave completion fields blank so your own evidence and decisions remain visible.

For a wider inventory, working guidance, supplier review and change records, see the Practical AI Governance Pack. Authentia's governance advisory can help your responsible teams structure the work.