Resource Center
Evaluate your organization's AI governance across six dimensions — from policy and oversight to vendor evaluation and staff training.
Work through each section and check the items that accurately describe your organization's current governance practices. Items marked critical represent the minimum governance baseline for responsible AI use. Use the results to identify gaps and prioritize governance work. This checklist is designed for organizations that are already using or actively planning to deploy AI tools.
A written AI use policy is the foundation of responsible AI governance. It defines what AI can and cannot be used for, who is responsible for AI decisions, and how AI use is monitored.
An AI use policy does not need to be long or complex. A two-page policy that is actually followed is more valuable than a comprehensive document that sits in a drawer.
AI systems can produce errors, biased outputs, and unintended consequences. Human oversight mechanisms ensure that AI outputs are reviewed before consequential decisions are made.
The level of human oversight required should be proportional to the stakes of the decision. Automating a routine email response requires less oversight than using AI in a hiring or lending decision.
AI introduces specific risks — algorithmic bias, data privacy violations, security vulnerabilities, reputational harm — that require proactive management.
Risk assessment does not need to be a formal process for every use case. A simple risk register that documents identified risks and mitigation measures is sufficient for most organizations.
Most organizations use third-party AI tools rather than building their own. Vendor evaluation criteria ensure that the tools you adopt meet your governance, privacy, and security requirements.
The most important vendor governance question is: "What happens to our data?" Many AI vendors use customer data to train their models. Understand this before signing any contract.
Responsible AI use requires transparency about when and how AI is being used, and clear accountability for AI outcomes.
Transparency requirements vary by sector and use case. Healthcare, legal, financial services, and government organizations face more stringent disclosure obligations than most other sectors.
AI governance is only effective if staff understand the policies, risks, and their responsibilities. Training is not a one-time event — it needs to be ongoing as AI tools and policies evolve.
The most effective AI training combines policy compliance (what you can and cannot do) with practical capability development (how to use AI tools effectively and responsibly). Both are necessary.
Focus first on the critical items. These represent the minimum governance baseline for responsible AI use.
Your organization has the minimum governance baseline in place. Focus on the non-critical items to build a more comprehensive governance framework.
Explore the AI Governance FrameworkAddress the missing critical items before expanding AI use. These gaps represent meaningful risk to your organization and the people affected by your AI systems.
Review the AI Governance FrameworkYour organization should pause AI adoption until foundational governance is in place. A governance framework development engagement can help you build the necessary foundation quickly.
Discuss governance developmentThis checklist was developed by Melissa Barton, AI consultant and marketing strategist, based on her AI governance framework development work with Florida businesses, nonprofits, and government agencies. It reflects the six-dimension governance framework she uses in formal engagements.
For a complete AI governance framework — including written policy, risk classification criteria, vendor evaluation standards, and oversight protocols — contact Melissa directly or read the AI Governance page.
A checklist identifies gaps. A governance framework closes them. Melissa develops customized AI governance frameworks for organizations that need more than a checklist.