All governance templates →← What does audit-ready AI documentation look like in practice?

Implementation Kit

AI Audit Documentation Checklist and Gap Analysis Template

What you would hand a regulator or plaintiff's attorney tomorrow, and how to find the gaps first. A gap analysis grid, a documentation package checklist by risk tier, a post-incident report template, and a tabletop scenario for a regulatory inquiry.

Who this is for: The compliance or legal owner responsible for producing an AI governance documentation package on demand.

Download the kit (Markdown) ↓4 artifacts. Every table also copies as CSV.

1. Documentation gap analysis

Spreadsheet

Required documents down one axis, systems across the other, status in each cell.

Template

Document	System A	System B	System C
Model card (current)	Present / Stale / Missing
Risk assessment (pre-deployment)
Data governance record
Bias / fairness evaluation
Human oversight arrangement
Change log / version history
Post-incident reports (if any)
Conformity assessment / FRIA (if triggered)

Worked example

Document	Resume Screener	Fraud Scoring	Support Copilot
Model card (current)	Stale (pre-v2.4)	Present	Missing
Risk assessment	Present	Present	Present
Data governance record	Present	Present	Present
Bias evaluation	Present (2026-08)	Present	N/A (no personal decisions)
Human oversight arrangement	Gap: no low-score review	Present	Present
Change log	Present	Present	Partial
Post-incident reports	None	None	1 (Sev-2, 2026-09)
Conformity / FRIA	Gap: not started	N/A	N/A

Acceptance criteria

✓Every high-risk system has a column, and every required document type has a row.
✓Cells use a consistent status vocabulary (present, stale, missing, not applicable).
✓Each gap has an owner and a target date in a tracking note.

2. Documentation package checklist by risk tier

Spreadsheet

What a complete package contains at each tier, so you can assemble one fast.

Template

Item	High	Moderate	Low
System description and intended use	Yes	Yes	Yes
Risk assessment with rationale	Yes	Yes	Optional
Model card	Yes	Yes	Optional
Data governance record (source, basis, minimization)	Yes	Yes	Optional
Evaluation results (performance, and bias where relevant)	Yes	Yes	No
Human oversight arrangement	Yes	If decisions affect people	No
Change and version history	Yes	Yes	Basic
Monitoring plan and recent results	Yes	Yes	No
Incident history and post-incident reports	Yes	Yes	Yes
Regulatory assessments (FRIA, DPIA) if triggered	Yes	If triggered	If triggered

Worked example

Package assembled for the Resume Screener (High) for a mock regulator request.

Item	Status	Note
System description and intended use	Included
Risk assessment with rationale	Included	2026-09
Model card	Included	refreshed to v2.4
Data governance record	Included
Evaluation results (perf + bias)	Included	adverse-impact 2026-08
Human oversight arrangement	Gap	drafted during the exercise
Change and version history	Included
Monitoring plan and recent results	Included
Incident history	Included	zero incidents
Regulatory assessments (FRIA)	Gap	scheduled 2026-10-31

Time to assemble: 2 days. Target is same-day; both gaps logged with owners.

Acceptance criteria

✓The checklist maps each item to where that document actually lives.
✓A package for at least one high-risk system has been assembled end to end as a test.
✓Assembly time is measured against a target (hours, not days).

3. Post-incident report template

Document

The report that becomes part of a system's permanent file after any AI incident.

Template

Completed within the window set by the incident process. Filed with the system's documentation.

Incident ID and date:
System and version:
Severity and classification:
Timeline: detection, containment, resolution, with timestamps
What happened: plain description of the failure and its effect
Who was affected: count and nature of impact
Root cause: technical and process
Immediate remediation: what was done to stop the harm
Preventive actions: changes to the model, controls, or process, with owners and dates
Regulatory or contractual notifications made:
Reviewer and sign-off:

Worked example

Incident ID: INC-2026-041, 2026-09-04
System: Support Copilot v1.6
Severity: Sev-2 (data exposure, caught pre-send)
Timeline: detected 14:10 by the pre-send review step; feature disabled 14:35; fix deployed 2026-09-06 09:00
What happened: the draft-reply feature pulled another customer's order ID into a suggested response from a mis-scoped retrieval query
Who was affected: zero customers (no message sent); one order ID exposed internally to one agent
Root cause: retrieval filter did not constrain by the current ticket's customer ID
Immediate remediation: disabled the draft feature for all workspaces
Preventive actions: add customer-ID scoping to retrieval (MLOps, done 2026-09-06); add a retrieval-boundary test to CI (MLOps, 2026-09-20)
Notifications: none required; no personal data left the company
Reviewer: R. Nkemelu, 2026-09-08

Acceptance criteria

✓The report is filed with the affected system's documentation, not only in a ticket.
✓Preventive actions have owners and dates and are tracked to closure.
✓The report records whether any notification obligation was triggered and what was done.

4. Regulatory inquiry tabletop scenario

Document

A dry run of a regulator asking for your AI documentation, to expose gaps before it is real.

Template

90 minutes. Governance lead facilitates. Legal, a system owner, MLOps, and comms attend.

Scenario: A regulator sends a formal request for the governance documentation on one named high-risk system, due in 10 business days. It asks for: intended use, risk assessment, training data governance, evaluation results including bias testing, human oversight arrangements, and any incidents.

Run the exercise:

Assign someone to actually retrieve each requested document now, on the clock.
Note what is missing, stale, or scattered.
Draft the cover response Legal would send.
Identify who signs, and whether they have what they need.

Capture: gaps found, time taken, owners and dates to close each gap, date of the next exercise.

Worked example

Exercise, 2026-09-10, target system: Fraud Scoring.

Retrieved in the room: system description, risk assessment, model card, evaluation, monitoring results, change log.
Missing or slow: bias testing summary was in a data-science notebook, not the file (30 min to locate and export). No consolidated human-oversight write-up; assembled from two docs.
Cover response drafted by Legal in 40 min.
Gaps: publish a standing bias-testing summary per release (owner: DS lead, 2026-09-30); write the human-oversight arrangement doc (owner: Risk Ops, 2026-09-24).
Time to a complete package: ~3 hours. Next exercise: 2027-03.

Acceptance criteria

✓The exercise produces a real documentation package under time pressure, not a discussion.
✓Every gap found has an owner and a close date.
✓The next exercise is scheduled before this one ends.

Governance controls this kit produces evidence for

Completing the artifacts above gives you a head start on the evidence requirements for these controls.

ALC-005

The gap analysis, package checklist, and tabletop are the regulatory audit-readiness process and its evidence.

ALC-002

The package checklist defines the high-risk audit trail contents; the assembled package is proof it exists.

CMP-007

The gap analysis flags where a conformity assessment or FRIA is required and tracks completion.

ALC-004

The model card and human-oversight items are the explainability documentation.

IRC-004

The post-incident report template is the post-incident review record, filed to the system.

This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.

Decide what to implement next

Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.

Start the AI governance assessment →