Introduction
Boards are asked to approve AI programmes without a shared vocabulary for residual risk, evidence, and accountability. This checklist is for regulated organisations that need decisions recorded — not slideware.
Why boards struggle
AI initiatives often arrive as product demos. Assurance artefacts — evaluation sets, decision logs, escalation paths — arrive later, if at all. That sequencing creates legal, reputational, and operational exposure.
Board test: If an auditor asked tomorrow for last month’s high-impact AI decisions, could you produce owners, citations, and refusal logs?
Twelve decisions to document
- Inventory — Which AI use cases are live or planned, and which data classes do they touch?
- Owners — Named executives for model risk, data stewardship, and incidents
- Tiering — Residual-risk classification with go/no-go criteria
- Evidence — What would an auditor ask for tomorrow, and where is it stored?
- Oversight — Human-in-the-loop gates for high-impact decisions
- Residency — Where prompts, embeddings, and model logs physically reside
- Third parties — Sub-processor map for model APIs, hosting, and logging
- Evaluation — Hold-out sets, red-team cadence, and release criteria
- Incidents — Playbook for harmful outputs, data leakage, and drift
- Training — Operator literacy pathway (WAIG Academy and chapter programmes)
- Budget — Assurance funding as a first-class line, not a residual after demos
- Review cadence — Board or risk-committee refresh after material model or regulatory change
Worked example
A benefits chatbot without retrieval guards or refusal policy can invent answers. A governed approach documents:
- Allowed policy corpora
- Citation rules before citizen-facing answers
- Escalation to a human case worker
- An evidence pack exportable for internal audit
See also: Human oversight patterns and Sovereign AI deployment insights.
30 / 60 / 90 day board pack
| Horizon | Outcome |
|---|---|
| 30 days | Use-case inventory + named owners |
| 60 days | Residual-risk tiers + HITL gates on one high-impact path |
| 90 days | Assurance evidence pack + board briefing |
Standards literacy (not legal advice)
Run a baseline with the AI Governance Maturity Assessment.
Content Attribution
Educational framing references public standards literacy. WAIG Foundation does not claim ownership of third-party standards text. Not legal, audit, or certification advice. Proprietary UAAF operational use requires written licence.
© WAIG Foundation