# Minimum Viable AI Governance Pack

Use this index once per organisation, then create linked records for every AI system or use case. This is an operational starting point, not legal advice.

## Shared record identity

- AI system ID:
- System or workflow name:
- Business owner:
- Risk tier: low / moderate / high / prohibited
- Approval status:
- Last review:
- Next review:
- Linked evidence location:

## 1. Acceptable-use policy

- Approved tools and access routes:
- Approved purposes:
- Restricted data and confidential information:
- Required human verification:
- Disclosure requirements:
- Prohibited uses and actions:
- How to request a new tool or use case:
- How to report an incident or concern:
- Policy owner and review date:

## 2. AI system register

| Field | Entry |
|---|---|
| Stable system ID | |
| Business purpose and intended outcome | |
| Vendor, service and model/configuration | |
| Users and affected people | |
| Data categories and sources | |
| Connected systems and permitted actions | |
| Risk tier and rationale | |
| Business, technical and incident owners | |
| Approval status and conditions | |
| Last / next review | |
| Suspension and retirement plan | |

## 3. Use-case risk assessment

- Intended use and explicit non-uses:
- Deployment context and users:
- Affected people and how they can challenge an outcome:
- Non-AI alternative:
- Plausible privacy, security, bias, reliability, safety, financial, contractual, IP and reputation harms:
- Impact, likelihood and reversibility for each material risk:
- Controls and evidence:
- Residual risk:
- Applicable jurisdictions, sector rules and contracts:
- Decision: approve / approve with conditions / revise / reject
- Decision owner, date and reassessment triggers:

## 4. Data and permission record

- Data categories, sources and purpose:
- Data minimisation, location, retention and deletion:
- Sensitive or prohibited data:
- Tool-by-tool rights: read / draft / recommend / write / send / approve / administer
- Identity and credential owner:
- Authentication and secret storage:
- Human approval gates:
- Logs and evidence retained:
- Revocation and emergency-disable method:
- Permission review owner and date:

## 5. Evaluation and release report

- Version under test: model, prompt, tools, data and configuration
- Representative normal, messy and adversarial cases:
- Task-success and quality thresholds:
- Policy, permission and prohibited-action tests:
- Grounding and evidence tests:
- Escalation and safe-failure tests:
- Security and privacy checks:
- Latency, cost and operational measures:
- Failures, mitigations and unresolved limitations:
- Release decision, approver and conditions:
- Regression-test owner and next review:

## 6. Monitoring and incident process

- Business, quality, control and technical signals:
- Alert thresholds and recipients:
- User complaint, appeal and override route:
- Triage severity and response target:
- Containment and emergency shutdown:
- Evidence preservation:
- Affected-record and affected-person assessment:
- Correction, recovery and notification decision:
- Root cause and lessons learned:
- Required updates to register, risk, permissions, tests and policy:

## 7. Accountability and review charter

- Executive sponsor:
- Business outcome and risk owner:
- Technical owner:
- Data/privacy owner:
- Security owner:
- Evaluation owner:
- Operations and incident owner:
- Who may approve, restrict, suspend and retire the system:
- Monthly operational review:
- Quarterly or half-year governance review:
- Event-driven review triggers:
- Escalation route when owners disagree:

## Starter review calendar

- Monthly: incidents, complaints, critical alerts, access changes and repeated corrections
- Quarterly: high-risk systems, vendor changes, residual risks and control effectiveness
- Half-yearly: low/moderate-risk inventory, policy, training and owner confirmation
- Event-driven: material model/prompt/data/tool change, new jurisdiction, new user group, expanded authority, incident, legal change or vendor notice

Source article: https://shuhaib.tech/blog/minimum-ai-governance-sme