How Prepared Is Your Businessfor AI Governance?

Is a named senior manager accountable for the firm’s use of AI, and is that recorded in your responsibilities map?

Does a governance forum — a committee or your existing risk forum — challenge and approve AI use before it is deployed?

Has the board or management body set a risk appetite for AI, with thresholds and escalation routes?

Do you keep an inventory of all AI use cases, including the models and providers each relies on?

Is each AI use case given a risk rating or tier that determines the controls, testing and oversight it needs?

Does your inventory distinguish experimental or pilot tools from production use?

Do employees use AI only through approved tools, with controls on what client or confidential data they can share?

Is employee AI activity logged so you can review it, investigate issues and deal with complaints?

Have you decided, based on risk, where a person must review, approve or be able to override AI outputs?

Do reviewers of AI outputs have the authority, information and expertise to challenge them — and do you check reviews are meaningful rather than box-ticking?

Is every AI agent registered with an owner, the systems and data it can access, and the controls that apply?

Do agents have defined limits and approval thresholds, and can you stop one quickly?

After deployment, do you monitor AI outcomes — not only technical metrics — with thresholds that trigger escalation?

Do you evaluate AI outputs against defined criteria (such as accuracy and completeness) and watch for model drift?

Where AI affects retail customers, did you define the consumer need and test outcomes across customer groups, including customers in vulnerable circumstances?

Do you tell customers when and how AI is used, explain its limits, and offer another route to support?

Have you assessed your AI providers, including how you learn about model changes, your fallback options and how you would exit?

Are your dependencies on AI models reflected in your operational resilience mapping and scenario testing?

Are AI decisions documented — rationale, challenge and approval — in records you could show a reviewer?

Do staff receive role-specific AI training — including senior managers and people who review AI outputs — and is competence checked?