An AI governance checklist tests what a firm can show today about the AI tools its staff already use. It covers which tools are on the list and approved, and what data may go into each. It also asks who owns each tool, who may use it, what gets recorded, where staff report a problem and when the list comes up for review. For each of the nine checks below, the reader first notes where the evidence sits and the date. Only then does a mark go beside it. The broader work of putting rules around AI use by staff sits on its own use case page.
Last reviewed 2026-11-02 by Manish Sharma.
AI Governance Checklist: What Gets Marked
In Signisys’ working method, the sheet covers every AI tool staff use for work today, with one line per tool. The leader marks it from inside the firm, together with two or three colleagues. That includes free web assistants staff signed up for on their own, as well as AI features switched on inside software the firm already runs. Why such a free account matters to a firm is traced through a deadline and a pasted file in the five points where a request can expose client data and advice.
An AI tool is any assistant, writing aid or built-in AI feature that takes text, files or questions from staff and returns an answer or a draft. A tool owner means the colleague answering for how staff use one tool. Approval means a dated decision, by a named person, that staff may use a tool, and for what.
The nine checks sit in four groups, and every group puts one question about the tools on the list. These groups and tests belong to that working method and are not drawn from any law or standard.
AI Governance Checklist: A Mark Only From Records
The reader dates the sheet first, then gives each check one mark for the whole firm, from records they can open on that day. This marking rule is part of the Signisys working method.
- Held (2): the reader opens the evidence, every tool on the list passes the test, and a dated line names the colleague who looked.
- Loose (1): the evidence covers some tools but not others, or it exists only in someone’s memory or an old message.
- None (0): there is no evidence to open, or what turns up fails the test.
Check 7 may not apply at every firm. For example, it has nothing to cover if no AI output feeds a decision about a person. In that case, the reader notes N/A and the reason. Then a sheet with one N/A counts out of 16 instead of 18. The reader marks the AI governance checklist against no target total and no pass band. Even so, a dated sheet lets the next reader see what changed between two markings.
Every AI Tool on One List, Each With a Decision
The tool list comes first. Its two checks ask whether the firm knows which AI tools staff use, and whether someone has decided on each.
| Check | Show this | Held when |
|---|---|---|
| 1. The IT lead keeps one list of every AI tool staff use for work, including free assistants on personal sign-ups and AI features inside existing software. | The list, with the date and the name of whoever compiled it. | A colleague has asked each team head about the tools their team uses and found none missing from the list. |
| 2. A named person has decided on each tool: approved, approved for some tasks only, or not for work use. | The decision column, naming who decided and when. | Every line has all three, and if staff use a tool marked “not for work use”, someone has told them so in writing. |
For check 1, the colleague can put two plain questions to each team head. Which assistants do people open in a browser, and which features did someone switch on inside existing software? Then the answers go on the list with the date. Later, check 2 starts from that same list.
What Data May Go Into Each Approved Tool
Data allowed is the second group of the AI governance checklist. Its two checks ask what staff may type or upload into each approved tool, and whether staff can find that rule.
| Check | Show this | Held when |
|---|---|---|
| 3. For each approved tool, the tool’s owner has written which kinds of business data staff may type or upload, and which they may not. | One line per tool, naming kinds of data such as published text, internal notes, customer details or staff records. | The data protection lead has agreed each line. |
| 4. Staff have a short written AI usage policy that names the approved tools and the data rules from check 3. | The policy, and a record of who received it. | A team head can show where staff find the policy, and every current staff member is on the record. |
The wording of each line in check 3 is for the data protection lead to settle. That person knows which privacy rules apply where the firm operates. Deciding which data counts as sensitive in the first place is a separate job, set out in the use case on sorting which business data counts as sensitive.
Key Takeaway In short, a data rule counts once the tool’s owner has written it, the data protection lead has agreed it and staff can find it.
Each Tool’s Owner and Its Users
Owners and users make up the third group. Here the checks ask who answers for each tool, and who may use it.
| Check | Show this | Held when |
|---|---|---|
| 5. The IT lead has named an owner for each approved tool, plus a deputy for the owner’s absences. | The two names beside each tool on the list. | Both people have confirmed the role in writing and know where the list lives. |
| 6. The tool’s owner has written who may use the tool and for which tasks, with access given on joining a team and removed on leaving it. | The user rule, and the record of the most recent leaver. | When the most recent leaver left, someone removed their access to every approved tool and dated the record. |
To test check 6, take the last person who left any team. Then look for that name on each approved tool in turn. If the deputy from check 5 does the looking, the same step also shows whether the deputy knows where the list lives.
Records, a Problem Route and a Review Date
Records and review close the sheet. The last three checks cover the notes the team keeps, where problems go and when the next review falls.
| Check | Show this | Held when |
|---|---|---|
| 7. When AI output fed a decision about a customer, a supplier or a staff member, the team notes the question, the tool and who checked the output before acting. | The note for one recent case. | A colleague who had no part in the case can find the note and read who checked the output. |
| 8. Staff and customers have a named route for reporting a problem with AI output, a named person who answers, and a set time for an answer. | The written route and the person’s name. | A test report sent through the route reached the named person, who answered within the set time. |
| 9. The list shows the next review date and who runs it, and the last review note is on file. | The date, the name and the last review note. | The date has not passed, and the filed note says what changed. |
Check 8 has a parallel in public guidance. In its guidelines for industry, the committee behind India’s national guidelines on AI recommends that anyone developing or deploying AI systems in India create a grievance redressal mechanism, so that people can report AI-related harms and see them resolved within a reasonable timeframe. That is a committee recommendation for India, not a law. Still, a GCC firm may treat it as a model for check 8.
AI Governance Checklist: The Lines to Close First
Every check marked None or Loose becomes an open line under its group name. A colleague’s name and the next marking date go beside it. Of each open line, the reader asks whether staff could be using a tool today without a written answer to what data went into it. Those lines close first. Until check 1, check 3 or check 5 earns Held, the team has no written answer yet to a question about that use. How a gap between agreed rules and real AI use can widen is described in why the distance between AI deployment and policy keeps growing.
A total on the AI governance checklist describes the listed tools as they stood when the reader marked them. It is no proof that the firm meets a law or a standard.
When a tool joins or leaves the list, the reader marks a fresh sheet and files it beside the old one. How a firm goes on to close the gaps the sheet shows is laid out in an order of work that starts with the AI already in use.
A Car Dealership Group and Check 3
Picture an invented car-dealership group in the GCC, with showrooms in several cities and no link to Signisys. Its sales staff draft replies to customer enquiries with a free web chat assistant they chose themselves. Meanwhile, the after-sales team uses an AI feature in its service-booking software. Take check 3, data allowed, and follow its three marks.
For Held, the owner of each tool has written which data staff may enter. For example, vehicle details may go in, but not a customer’s identity documents or finance papers. In addition, the data protection lead has agreed both lines.
Loose fits a group where the after-sales owner has written a line for the booking feature, while the line for the chat assistant is still unwritten.
If no line exists for either tool and each salesperson decides alone, the check earns None.
For this group, check 3 has a plain test on the showroom floor. If a customer asks what happened to the details they shared, the sales manager has no answer until a line exists.
Key Takeaway Overall, the dealership group earns Held on check 3 only when both tools have a written line that the data protection lead has agreed.
Once One Sheet Is Filed
A new tool on the list gets its own line and the nine checks. The tool list, the evidence notes and every marked sheet sit together in one place that the IT lead and the tool owners can open. A firm planning a new AI tool can judge its readiness for that tool separately, through the use case on checking readiness before a new AI tool is added. Security testing of a tool, the accuracy of its answers and legal compliance are separate pieces of work. In other words, the AI governance checklist records governance evidence for listed tools only. Signisys can mark the sheet alongside the firm’s IT or compliance lead, for the tools that lead names.
Signisys offers enterprise AI solutions and data, analytics and AI services, so its view on this subject is not neutral. Its pages on enterprise AI solutions and data, analytics and AI services set out its offer. The consultation box below is an offer from Signisys, with no outcome promised.
AI Governance Checklist FAQ: Plain Answers
Does the AI governance checklist cover free AI tools staff signed up for themselves?
Can one manager mark the AI governance checklist without a team?
Who keeps the AI governance checklist between reviews?
What if staff use an AI feature built into software the firm already has?
Should the sheet be redone when a new AI tool is approved?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.