Implementation Kit
AI Governance Best Practices Checklist and Gap Template
A baseline of practices that hold up under scrutiny, each mapped to a control domain and playbook, plus a way to verify they are real: an enforcement verification log and a ranked gap list.
Who this is for: The governance lead pressure-testing the program against a practical baseline.
1. Best-practice baseline checklist
SpreadsheetThe practices to have in place, each tied to its domain and the playbook that explains it.
Template
| Practice | Domain | Playbook | In place? | Evidence |
|---|---|---|---|---|
| A complete, owned AI inventory with risk tiers | inventory | complete-ai-inventory | Y / partial / N | |
| A repeatable risk classification method | risk | how-to-perform-ai-risk-assessment | ||
| Signed risk assessments for all high-risk systems | risk | how-to-perform-ai-risk-assessment | ||
| Meaningful human oversight for consequential decisions | oversight | human-oversight-for-high-risk-ai-decisions | ||
| Bias testing with a re-test cadence for people-affecting systems | monitoring | algorithmic-bias-detection-and-mitigation | ||
| Decision-level logging you can reconstruct | audit | ai-decision-auditability | ||
| Production monitoring with thresholds and alerting | monitoring | model-drift-monitoring | ||
| An incident runbook and register, drills run | incident | ai-incident-response | ||
| Vendor due diligence and monitoring for material AI vendors | third-party | third-party-ai-vendor-due-diligence | ||
| A regulatory obligation map kept current | regulatory | regulatory-obligations-for-ai | ||
| Quarterly board reporting reconciled to source | board | board-ai-risk-reporting | ||
| Independent assurance of the program annually | assurance | ai-governance-auditing |
Worked example
| Practice | In place? | Evidence |
|---|---|---|
| Complete owned inventory with tiers | partial | 2 systems found off-register in audit |
| Repeatable risk classification | Y | method doc + rubric |
| Signed assessments for all high-risk | partial | 1 of 3 unsigned |
| Meaningful human oversight | N | oversight is a formality (audit finding) |
| Bias testing with cadence | partial | protocol exists; last run 7 weeks ago |
| Decision-level logging | Y | 25/25 sampled decisions fully logged |
| Monitoring with alerting | N | metrics defined, no alerts |
| Incident runbook + register + drills | Y | 1 drill run |
| Vendor DD + monitoring | partial | DD done; monitoring cadence not enforced |
| Regulatory map current | partial | mapping in progress |
| Board reporting reconciled | partial | template + cadence; not reconciled |
| Annual independent assurance | Y | H1 internal audit complete |
Acceptance criteria
- ✓Every practice is rated in place, partial, or not, with evidence for the rating.
- ✓Ratings come from verification, not self-assessment.
- ✓Each practice links to the domain and playbook a reader can go to for detail.
2. Enforcement verification log
SpreadsheetA record of which practices were tested against actual system behaviour, not just policy review.
Template
| Practice | Verification method | Date | Result | Verified by |
|---|---|---|---|---|
| <practice> | behaviour test / log sample / config check / drill / interview | YYYY-MM-DD | pass / partial / fail + note | <name> |
Worked example
| Practice | Verification method | Date | Result | Verified by |
|---|---|---|---|---|
| Decision-level logging | sampled 25 decisions across 2 systems | 2026-09-08 | pass | Internal Audit |
| Human oversight is meaningful | 5 reviewer interviews + override-rate data | 2026-09-08 | fail (formality) | Internal Audit |
| Deployment gate enforced | checked last 10 deploys vs registry | 2026-09-09 | partial (8/10) | Internal Audit |
| Incident runbook works | tabletop of a data-exposure incident | 2026-08-30 | partial (no holding statement ready) | Governance |
| Bias re-test cadence | checked test logs | 2026-09-08 | fail (overdue) | Internal Audit |
Acceptance criteria
- ✓Each entry names a verification method that tests behaviour or records, not a document read.
- ✓Failed and partial results carry a note on what was wrong.
- ✓Practices not yet verified are visible as blanks, not assumed to pass.
3. Ranked gap list
SpreadsheetThe gaps, ordered by whether a practice is missing entirely versus partially there, so effort goes to the worst first.
Template
| Rank | Practice | State | Why it ranks here | Owner | Target |
|---|---|---|---|---|---|
| 1 | missing / partial | YYYY-MM-DD |
Worked example
| Rank | Practice | State | Why it ranks here | Owner | Target |
|---|---|---|---|---|---|
| 1 | Meaningful human oversight | partial but failing | High-tier, regulator-relevant, currently provides no protection | Head of Talent | 2026-11-15 |
| 2 | Monitoring with alerting | missing | production models can degrade undetected | ML Platform | 2026-11-01 |
| 3 | Bias re-test cadence | partial | protocol exists but lapsed; quick to fix | DS team | 2026-10-01 |
| 4 | Signed assessments for all high-risk | partial | 1 of 3; the assessment is nearly done | Compliance | 2026-10-15 |
| 5 | Regulatory map current | partial | in progress; no imminent deadline missed | Compliance | 2026-11-30 |
Acceptance criteria
- ✓Gaps are separated into "missing entirely" and "partially implemented".
- ✓Ranking weighs risk exposure and regulatory relevance, not just ease.
- ✓Every gap has an owner and a target date and is tracked to closure.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The baseline checklist and ranked gap list are a governance-program milestone and remediation plan.
The baseline assessment feeds the governance maturity assessment.
The enforcement verification log is continuous-assurance evidence that practices operate, not just exist.
Verifying oversight is meaningful tests the automation-bias control.
The verification log contributes to regulatory audit readiness.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.
Decide what to implement next
Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.
Start the AI governance assessment →