Implementation Kit
AI Governance Best Practices Checklist and Gap Template
A baseline of practices that hold up under scrutiny, each mapped to a control domain and playbook, plus a way to verify they are real: an enforcement verification log and a ranked gap list.
Who this is for: The governance lead pressure-testing the program against a practical baseline.
1. Best-practice baseline checklist
SpreadsheetThe practices to have in place, each tied to its domain and the playbook that explains it.
Template
| Practice | Domain | Playbook | In place? | Evidence |
|---|---|---|---|---|
| A complete, owned AI inventory with risk tiers | inventory | complete-ai-inventory | Y / partial / N | |
| A repeatable risk classification method | risk | how-to-perform-ai-risk-assessment | ||
| Signed risk assessments for all high-risk systems | risk | how-to-perform-ai-risk-assessment | ||
| Meaningful human oversight for consequential decisions | oversight | human-oversight-for-high-risk-ai-decisions | ||
| Bias testing with a re-test cadence for people-affecting systems | monitoring | algorithmic-bias-detection-and-mitigation | ||
| Decision-level logging you can reconstruct | audit | ai-decision-auditability | ||
| Production monitoring with thresholds and alerting | monitoring | model-drift-monitoring | ||
| An incident runbook and register, drills run | incident | ai-incident-response | ||
| Vendor due diligence and monitoring for material AI vendors | third-party | third-party-ai-vendor-due-diligence | ||
| A regulatory obligation map kept current | regulatory | regulatory-obligations-for-ai | ||
| Quarterly board reporting reconciled to source | board | board-ai-risk-reporting | ||
| Independent assurance of the program annually | assurance | ai-governance-auditing |
Worked example
| Practice | In place? | Evidence |
|---|---|---|
| Complete owned inventory with tiers | partial | 2 systems found off-register in audit |
| Repeatable risk classification | Y | method doc + rubric |
| Signed assessments for all high-risk | partial | 1 of 3 unsigned |
| Meaningful human oversight | N | oversight is a formality (audit finding) |
| Bias testing with cadence | partial | protocol exists; last run 7 weeks ago |
| Decision-level logging | Y | 25/25 sampled decisions fully logged |
| Monitoring with alerting | N | metrics defined, no alerts |
| Incident runbook + register + drills | Y | 1 drill run |
| Vendor DD + monitoring | partial | DD done; monitoring cadence not enforced |
| Regulatory map current | partial | mapping in progress |
| Board reporting reconciled | partial | template + cadence; not reconciled |
| Annual independent assurance | Y | H1 internal audit complete |
Acceptance criteria
- ✓Every practice is rated in place, partial, or not, with evidence for the rating.
- ✓Ratings come from verification, not self-assessment.
- ✓Each practice links to the domain and playbook a reader can go to for detail.
2. Enforcement verification log
SpreadsheetA record of which practices were tested against actual system behaviour, not just policy review.
Template
| Practice | Verification method | Date | Result | Verified by |
|---|---|---|---|---|
| <practice> | behaviour test / log sample / config check / drill / interview | YYYY-MM-DD | pass / partial / fail + note | <name> |
Worked example
| Practice | Verification method | Date | Result | Verified by |
|---|---|---|---|---|
| Decision-level logging | sampled 25 decisions across 2 systems | 2026-09-08 | pass | Internal Audit |
| Human oversight is meaningful | 5 reviewer interviews + override-rate data | 2026-09-08 | fail (formality) | Internal Audit |
| Deployment gate enforced | checked last 10 deploys vs registry | 2026-09-09 | partial (8/10) | Internal Audit |
| Incident runbook works | tabletop of a data-exposure incident | 2026-08-30 | partial (no holding statement ready) | Governance |
| Bias re-test cadence | checked test logs | 2026-09-08 | fail (overdue) | Internal Audit |
Acceptance criteria
- ✓Each entry names a verification method that tests behaviour or records, not a document read.
- ✓Failed and partial results carry a note on what was wrong.
- ✓Practices not yet verified are visible as blanks, not assumed to pass.
3. Ranked gap list
SpreadsheetThe gaps, ordered by whether a practice is missing entirely versus partially there, so effort goes to the worst first.
Template
| Rank | Practice | State | Why it ranks here | Owner | Target |
|---|---|---|---|---|---|
| 1 | missing / partial | YYYY-MM-DD |
Worked example
| Rank | Practice | State | Why it ranks here | Owner | Target |
|---|---|---|---|---|---|
| 1 | Meaningful human oversight | partial but failing | High-tier, regulator-relevant, currently provides no protection | Head of Talent | 2026-11-15 |
| 2 | Monitoring with alerting | missing | production models can degrade undetected | ML Platform | 2026-11-01 |
| 3 | Bias re-test cadence | partial | protocol exists but lapsed; quick to fix | DS team | 2026-10-01 |
| 4 | Signed assessments for all high-risk | partial | 1 of 3; the assessment is nearly done | Compliance | 2026-10-15 |
| 5 | Regulatory map current | partial | in progress; no imminent deadline missed | Compliance | 2026-11-30 |
Acceptance criteria
- ✓Gaps are separated into "missing entirely" and "partially implemented".
- ✓Ranking weighs risk exposure and regulatory relevance, not just ease.
- ✓Every gap has an owner and a target date and is tracked to closure.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The baseline checklist and ranked gap list are a governance-program milestone and remediation plan.
The baseline assessment feeds the governance maturity assessment.
The enforcement verification log is continuous-assurance evidence that practices operate, not just exist.
Verifying oversight is meaningful tests the automation-bias control.
The verification log contributes to regulatory audit readiness.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.