AI Governance Templates for Operational Decisions

Template 1: use-case intake record

Record the business task, user group, intended benefit, approved tool, data classes, inputs, outputs, downstream audience, human owner, non-AI alternative, foreseeable failures, and affected parties. Add links to current product, security, privacy, procurement, and legal evidence. Mark unknowns rather than filling them with assumptions.

The NIST AI RMF is a voluntary framework organized around govern, map, measure, and manage. Its Core emphasizes purpose, risk tolerance, roles, oversight, documentation, testing, and ongoing review (AI RMF overview, AI RMF Core). These templates can support implementation but do not establish compliance or control effectiveness.

Sources: [1] [2]

Template 2: risk decision record

For each material risk, document scenario, affected asset or person, existing evidence, likelihood rationale, impact rationale, uncertainty, treatment options, selected response, owner, due date, residual risk, and approval authority. Separate technical analysis from the accountable decision.

Use four possible responses where appropriate: mitigate, avoid, transfer, or accept. The template should record why an option was chosen, not only its color on a heat map. Add a stop condition and reassessment trigger.

Template 3: control evidence log

Each row contains control objective, operating procedure, system or team, owner, frequency, expected evidence, latest test, exception, and remediation. A written rule is design evidence. A configuration export, sample test, or audit event may provide operating evidence. Neither should be silently substituted for the other.

Worked governance pack

Consider a synthetic internal summarization use case. Employees want an approved assistant to summarize public consultation documents. The intake record limits sources to public documents and outputs to internal research notes. The risk decision identifies citation error and outdated-source risk. Controls require exact source links, date display, and reviewer confirmation before a summary informs a public statement.

The evidence log stores sampled source checks and unresolved exceptions. An exception request for confidential documents is denied pending an approved environment and data review. The review card schedules reassessment after a model or connector change.

A failed governance sheet says “low risk, approved” without task, data, evidence, conditions, or authority. The repaired pack shows each element and the decision trail.

Template 4: exception and incident record

Record request or event, date, affected use case, evidence, immediate containment, temporary condition, approver, expiry, root-cause status, corrective action, and closure test. Do not let temporary access become permanent through missing expiry. Preserve the original record when interpretation changes.

Template 5: periodic review card

Ask whether purpose, users, data, model, vendor terms, integrations, performance, risks, controls, laws, or organizational tolerance changed. Record what evidence was examined and whether the use case continues, changes, pauses, or closes.

Connect the templates without duplicating truth

Give each use case a stable identifier and reference it from the risk, control, exception, incident, and review records. Store a fact once, then link to it. For example, the approved data boundary should live in the current use-case record rather than be copied into five spreadsheets that can drift. Record effective dates and preserve prior versions. A governance index can show the current state and next action without exposing every sensitive detail. Test links and permissions so reviewers can reach the evidence they are authorized to inspect.

When an incident changes a risk assumption, update the risk record through a versioned decision. Do not quietly rewrite the original assessment. This preserves what was knowable at each approval point and gives later reviewers a usable trail.

Verification checklist:

The pack creates governance memory. It is not a certification, legal conclusion, or evidence that risk has been eliminated.

• Every template has a named decision and owner.
• Facts, assumptions, risk analysis, and approval remain separate.
• Controls specify expected operating evidence.
• Exceptions have scope, expiry, and closure criteria.
• Material changes trigger reassessment.
• Qualified functions review jurisdiction-specific obligations.
• Records do not claim effectiveness without testing evidence.