A working instrument, not a slide. Apply all five phases — Situate, Tension-test, Establish, Evidence, Roll out & review — to your own organization's risks, stakeholders, and regulatory exposure, and leave with a scored governance posture.
Helios Capital — a mid-size retail bank operating in the EU and India. Two AI systems in production: an ML credit-scoring model (high-risk under the EU AI Act) and a GenAI customer assistant built on a foundation model. Every output below carries a worked Helios example. Replace Helios with your organization as you go.
Where does AI actually live in your organization, and who has power over it?
Inventory every AI system by purpose, criticality, data sensitivity, and decision authority (advisory vs. autonomous).
Surface ungoverned use: personal LLM accounts, browser extensions, vendor features quietly switched on, spreadsheet macros calling APIs.
Score each system on impact × oversight maturity. The top-right quadrant — high impact, low oversight — is your burn-down list.
Map regulators, board, unions, customers, model owners, and civil society on power vs. interest. The grid below is interactive — tap a stakeholder.
Build your AI footprint map. Priority is computed automatically from impact × oversight gap — your burn-down list forms itself.
No systems added yet — your inventory appears here.
Map your stakeholders. The engagement strategy is assigned by quadrant.
No stakeholders mapped yet.
A complete AI inventory exists, including vendor-embedded and shadow systems, refreshed at least quarterly.
Every system is classified by decision authority (advisory / autonomous) and data sensitivity.
A shadow-AI amnesty or detection mechanism has run in the last 6 months.
Governance gaps are scored on an impact × oversight matrix with a named priority list.
A stakeholder power/interest map exists with an engagement strategy per quadrant.
Governance is not about eliminating trade-offs. It is about deciding them in the open — and writing down what you will never trade.
Trace bias entry points across the lifecycle: historical data → labels → features → objective function → thresholds → human use.
Log each tension (accuracy vs. equity, personalization vs. privacy, speed vs. review), the options considered, the decision, and the owner.
Non-negotiables that no business case can override. Few, absolute, board-ratified.
Test outcomes against applicable law: EU AI Act Art. 10 (data governance), ECOA-style fair-lending rules, Indian DPDP Act, local equality statutes.
Drag the threshold. There is no setting where nothing is sacrificed — which is precisely why the decision must be owned, documented, and reviewable.
No fully autonomous adverse decision. Every loan denial, account closure, or fraud freeze has a human appeal path with a 10-day SLA.
No protected attributes or close proxies as features. Proxy audit (pin-code, name, device language) runs at every retrain.
No customer data into external models without contractual no-training guarantees and regional data residency.
No deployment of an undocumented model. No model card, no production — regardless of revenue at stake.
No dark patterns from the GenAI assistant. It must disclose it is AI, must not impersonate staff, and must hand off on request.
Write your ethical red lines — few, absolute, board-ratifiable.
No red lines yet — aim for three to six.
Log your fairness tensions and the decisions you've made — owned trade-offs, not hidden ones.
Trade-off register is empty.
Bias entry points are mapped across the full pipeline for each high-impact system.
A trade-off register exists with decisions, rationale, named owners, and review dates.
Ethical red lines are written, board-ratified, and have actually blocked at least one proposal (or are credibly enforceable).
Disparate-impact metrics are measured on production outcomes, not just training data.
Fairness definitions used (parity, equalized odds, calibration) are chosen deliberately and documented per use case.
Who decides, who is consulted, who can veto — and what happens when they disagree?
State each principle alongside the tension it creates, so the charter reads as honest rather than aspirational.
A standing cross-functional body with quorum rules, cadence, veto rights, and a published escalation path to the board.
A decision-rights table (below) so every consequential call has exactly one accountable name — committees advise, individuals answer.
A small policy stack — acceptable use, procurement, data, incident response, model lifecycle — each mapped to an owner and review cycle.
| Decision | Accountable | Consulted | Veto held by | Tier |
|---|---|---|---|---|
| Approve high-risk system for production | Chief Risk Officer | Council, Legal, DPO | CRO | TIER 1 |
| Approve new external GenAI tool | CDO | CISO, Procurement | CISO (security) | TIER 2 |
| Retrain / threshold change, existing model | Model owner | Validation team | Head of Model Risk | TIER 2 |
| Low-risk internal productivity use | Business-line lead | — | — | TIER 3 |
| Exception to a red line | None — not delegable | Full board | Board Risk Committee | BOARD |
Assign your decision rights — every consequential decision gets exactly one accountable name.
No decision rights assigned yet.
A governance council exists with a written charter, quorum rules, and a board escalation path.
Every consequential AI decision type maps to exactly one accountable individual.
A risk-tiering scheme determines which approvals each system needs before deployment.
The policy stack is short, owned, versioned, and reviewed on a fixed cycle.
Stated principles explicitly acknowledge the tensions they create and how conflicts are resolved.
When the regulator, the auditor, or the journalist calls — everything else is intention.
One card per production system: purpose, data lineage, performance by subgroup, known limits, and the human-oversight design. Expand the live template below.
An append-only register of governance decisions: what, who, when, evidence considered, dissent recorded. Dissent is data, not noise.
One cross-walk from EU AI Act articles to NIST AI RMF functions to ISO/IEC 42001 clauses — so one piece of evidence serves three frameworks (table below).
Immutable logs of model versions, inputs to consequential decisions, overrides, and incidents — plus periodic independent review.
| Governance artifact | EU AI Act | NIST AI RMF | ISO/IEC 42001 |
|---|---|---|---|
| Risk assessment & tiering | Art. 9 — risk management | MAP · MEASURE | §6.1 risk & opportunity |
| Model card + data lineage | Art. 10–11, Annex IV | MAP 1.6 / MEASURE 2.x | §7.5 documented info |
| Human-oversight design | Art. 14 — oversight | GOVERN 3 / MANAGE 2 | §8 operational control |
| Decision log + audit trail | Art. 12 — record-keeping | GOVERN 4 / MANAGE 4 | §9.1 monitoring |
| Incident & withdrawal procedure | Art. 73 — serious incidents | MANAGE 4.1–4.3 | §10 improvement |
Your documentation ledger. Systems you added in Situate appear here automatically — tap a status to cycle it (None → Draft → Signed). Red line 4 applies: no model card, no production.
Add AI systems in the Situate workspace to track their model cards here.
Every production AI system has a current, signed model card with subgroup performance.
An append-only decision log captures rationale and dissent for governance decisions.
A single cross-walk maps your evidence to EU AI Act, NIST AI RMF, and ISO 42001.
Consequential decisions are reproducible: model version, inputs, and override identity are retained.
An independent party (internal audit or external) has tested the assurance layer in the last 12 months.
A 90-day plan with named owners prevents the first. A quarterly scorecard prevents the second.
"By 2027, every consequential AI decision at Helios will be explainable to the customer it affects, defensible to the regulator who asks, and reversible by the human who owns it."
Helios — board-ratified governance vision statement · Output 1 of 5| Audience | Message | Channel & cadence | Owner |
|---|---|---|---|
| Board | Risk posture, red-line status, health scorecard trend | Quarterly committee paper | CRO |
| Regulators | Proactive disclosure of Tier-1 changes; evidence readiness | Pre-notification + annual brief | General Counsel |
| All staff | What you may use, how to report concerns — no jargon | Launch town hall + intranet hub | CDO |
| Customers | Where AI touches them, how to appeal a decision | Plain-language fact sheet, always-on | Head of CX |
| Researchers / public | Methodology transparency; published fairness statistics | Annual transparency report | Council |
Write your board-ready vision statement — one sentence, ratifiable.
Build your 90-day plan — every action needs a named owner and a S.T.E.E.R. phase.
No quick wins yet.
Nothing scheduled.
Nothing scheduled.
A board-ready governance vision statement exists in one sentence, ratified — not drafted.
The 90-day plan has named individual owners and each action maps to a S.T.E.E.R. phase.
At least three 30-day quick wins are complete and visible to staff.
Each stakeholder audience has a defined message, channel, cadence, and owner.
The health scorecard is reviewed quarterly and at least one action changed because of it.
Data lives in this browser session only — download your .json to save progress and import it later to resume.