A committee that can only discuss and recommend is not governance. Real authority means the power to approve, block, and be held accountable.

Scrambling to assemble evidence when an audit is announced means the evidence was never really being kept in the first place.

Using personal or proprietary data to train a model without a documented legal basis is a liability, not a technical detail.

Signing an AI vendor contract before security review means the risk decision happens after the money has already moved.

A bias test on the wrong population proves nothing. The test population has to match who the system actually affects.

An explanation that satisfies an engineer will not satisfy a regulator or an affected customer. Explainability has to be built for the person asking.

Vendor AI claims are marketing until verified. A repeatable vetting process is what turns a sales pitch into an informed procurement decision.

Risk tiers only work when every team applies the same criteria. Inconsistent tiering lets high-impact systems slip through as “low risk.”

Scattered spreadsheets cannot govern AI. A single, maintained use case register is what makes an AI policy enforceable across a company.

An AI policy only works when one named owner can approve, reject, and log decisions. This guide sets out how to assign that role and keep it accountable.