Guides · Executive guide
How to run your first AI governance review
A working agenda for the meeting that turns AI oversight into decisions, not status updates.
Executive takeaways
- Prepare an owner-attributed inventory and review its changes first.
- Require risk assessments, control evidence and open exceptions before the meeting.
- Close with enforceable decisions — approve, restrict or pause — with named owners and dates.
An AI governance review earns its place on the calendar when it changes a decision: a use is approved, restricted, paused or expanded. The first review sets that tone. Prepare a one-page inventory of AI in use — purchased copilots, embedded model features, internal agents — with a named business owner and intended purpose for each entry. An incomplete inventory is acceptable; an ownerless one is not.
Open with the inventory deltas, not the policy. Which systems are new, changed or stopped since the last cycle? Which entries still lack an accountable owner or an approved use statement? Ask the presenting owner to describe the workflow in business terms and to name the decisions the system can influence. Discussion follows the risk, not the technology.
For each consequential use, require three artifacts before the meeting: a short risk assessment from the owner, evidence that access and approval controls were tested, and the open exceptions with owners and dates. Reviewers should arrive having read them; the meeting is for challenge and decisions, not first-time reading. Where evidence is missing, record the gap and set a review date rather than deferring the use indefinitely.
Close with explicit decisions and a risk-appetite check. Approve, approve with conditions, restrict or pause — and write down who owns the action and by when. Conditions should be enforceable in the surrounding systems, such as limiting users or transactions, not intentions in a document. Confirm which unresolved items escalate to the board or audit committee.
End by agreeing the rhythm: what management reports between reviews, what triggers an out-of-cycle review, and what the next meeting will cover. Keep the pack short — inventory changes, decisions taken, incidents, exceptions and progress on gaps. Use a governance self-assessment to structure the first discussion, then validate answers with the people who operate the controls. This guide is general executive guidance, not legal, regulatory or audit advice.
General executive guidance, not legal, regulatory or audit advice. Diagnostics are self-assessments, not certifications or independent assurance.
← All insights