AI governance does not have to start with a large programme. It starts with clear responsibilities, a reliable picture of what is in use and a small set of rules that people actually follow. This checklist covers the basics. Work through it in order, keep it proportionate to your size and record what you decide.
The checklist draws on the EU AI Act, the GDPR and established frameworks such as ISO/IEC 42001:2023 and the NIST AI Risk Management Framework. It does not replace a legal assessment of individual use cases.
1. Owners and policy
- Name an accountable executive for AI at management level
- Set up a small cross-functional group: business, IT, information security, data protection, legal and HR
- Define who approves new AI use cases and who can grant exceptions
- Write a short AI policy: permitted tools, prohibited uses, data rules and approval route
- Publish the policy where employees will find it and review it at least once a year
2. Inventory
An inventory is the basis for every later step. Aim for completeness first and detail second.
- List all AI systems in use, including AI features in existing SaaS products
- Identify shadow AI, for example from proxy, identity or endpoint data
- Record owner, vendor, purpose, users, affected people and data categories per system
- Record your role per system under the EU AI Act: provider or deployer
- Include agents and automations, not only chat tools
3. Intake and approval
A clear intake route stops new AI use from bypassing review, and gives employees a quick way to get a yes.
- Create a single entry point for new AI requests
- Use a short intake form: purpose, data, users, vendor, expected decisions
- Route requests to data protection and security reviews based on risk
- Document approvals, conditions and accepted risks with an expiry date
- Re-assess when the purpose, data or model changes
4. Risk classification
Classification decides how much scrutiny a use case needs. Keep the method simple enough that it is applied consistently.
- Check every use case against the prohibited practices in Article 5 of the EU AI Act
- Flag likely high-risk use cases, for example in HR, credit or access to essential services
- Identify transparency duties, such as deep fakes and emotion recognition
- Rate business, privacy and security risk on a simple, consistent scale
- Set review intervals by risk level
5. Data protection
Most AI use cases involve personal data at some point. Treat them like any other processing activity under the GDPR.
- Confirm a legal basis under Article 6 GDPR, and an Article 9 exception for special categories
- Carry out a data protection impact assessment (Article 35) where risk is likely to be high
- Sign processor agreements under Article 28 and check whether vendors train on your data
- Assess third-country transfers and sub-processors
- Update your records of processing activities (Article 30)
6. Security controls
AI adds new attack paths, such as prompt injection, but most controls build on security basics you already have.
- Enforce single sign-on, multi-factor authentication and least privilege for AI tools
- Fix oversharing before connecting AI to document stores
- Apply guardrails against prompt injection and data leakage, guided by the OWASP Top 10 for LLM Applications
- Redact or pseudonymise personal data before it reaches external models
- Log AI activity and feed relevant events into your security monitoring
7. Evidence and training
Governance only counts if you can show it. Plan evidence from the start, and make training part of every rollout.
- Keep inventory, assessments, approvals and exceptions in one place with version history
- Collect evidence continuously rather than before audits
- Provide role-based AI literacy training, as required by Article 4 of the EU AI Act, and record attendance
- Report AI risk status to management at regular intervals
- Fidempli helps you set up these steps through consulting, professional and managed services, supported from December 2026 by the Fidempli platform