AI Governance Checklist for Growing Companies

Your sales team is using an AI note-taker, marketing has 3 writing tools, engineering ships features built on a large language model, and HR is trialing a resume screener. Nobody is quite sure which tools touch customer data, who approved them or what happens if one gets something badly wrong. That is the moment most growing companies realize they need AI governance.

AI governance does not have to mean a committee and a 60-page policy. For a company of 20 to 2,000 people, it means knowing what AI you use, who owns it, how risky it is and how you will notice when it misbehaves. This checklist walks through each piece, mapped to the frameworks auditors and customers increasingly ask about.

What AI governance means for a growing company

AI governance is the system of policies, roles, processes and records that guides how an organization selects, builds, uses and monitors AI. Its goals are practical:

• Use AI where it creates value, without blocking teams
• Protect customer, employee and company data
• Avoid legal problems such as discrimination, privacy violations or misleading claims
• Catch errors and drift before customers or regulators do
• Answer due diligence questions from customers, investors and insurers

It builds on what you already have. If you have a security program, privacy practices or data governance, AI governance extends them rather than starting over.

The frameworks behind this checklist

You do not need to adopt a formal framework on day one, but it helps to borrow from the ones that customers and regulators recognize:

The checklist below follows the NIST functions in plain language. If you later pursue ISO/IEC 42001 certification, this work becomes your foundation. Companies with European exposure should also read what the EU AI Act means for US companies.

Checklist part 1: Inventory

You cannot govern what you cannot see. Build a single AI register, even a spreadsheet to start.

• [ ] List every AI system you build, buy or use, including AI features inside existing software (CRM, help desk, HR, office suites)
• [ ] Survey teams for tools adopted without IT approval, including free and personal accounts
• [ ] For each system, record: purpose, business owner, vendor, users, data it accesses, decisions it influences and where outputs go
• [ ] Note whether it touches personal data, customer data, confidential IP or regulated data (health, financial, children’s data)
• [ ] Note whether it affects people in specific jurisdictions (EU, states with AI laws)
• [ ] Set a rule that new AI tools are added to the register before use, and review the register quarterly

Checklist part 2: Ownership and policy

• [ ] Name an executive sponsor for AI governance (often the CTO, COO, general counsel or CISO)
• [ ] Form a small cross-functional review group: legal or compliance, security, privacy, IT and a business leader
• [ ] Assign a named owner for every AI system in the register, responsible for its performance and risks
• [ ] Publish an employee AI acceptable use policy covering approved tools, prohibited data, human review and disclosure. Our guide to writing an AI acceptable use policy includes an outline
• [ ] Define who can approve new AI tools at each risk level
• [ ] Provide AI literacy training for staff who use or build AI, and keep training records

Key takeaway: The most important control in AI governance is a named owner. Every AI system in your register should have one person accountable for its data, performance and risks.

Checklist part 3: Risk review before launch

Not every AI tool needs the same scrutiny. Tier your systems, then apply review effort accordingly.

Assign a risk tier:

• [ ] High: Influences consequential decisions about people (hiring, pay, credit, pricing, insurance, health, education, housing), operates autonomously, or processes sensitive data at scale
• [ ] Medium: Customer-facing outputs (chatbots, generated content) or access to confidential data
• [ ] Low: Internal productivity uses with no sensitive data and human review of outputs

For medium- and high-risk systems, document:

• [ ] Intended use, users and people affected, and uses that are out of scope
• [ ] Legal and regulatory requirements that apply, such as anti-discrimination, privacy, consumer protection and state AI laws
• [ ] Data sources, quality checks and data rights (are you allowed to use this data this way?)
• [ ] Testing results for accuracy, robustness and fairness across groups. Our explainer on AI bias covers how to test
• [ ] Security review, including prompt injection, data leakage and access control for AI agents
• [ ] Human oversight design: when a person reviews or can override outputs
• [ ] Transparency: whether users must be told they are dealing with AI, and how
• [ ] Sign-off by the owner and, for high-risk systems, the review group

Checklist part 4: Vendor and data controls

Most growing companies buy far more AI than they build, so vendor review is where governance does most of its work.

• [ ] Confirm whether the vendor trains models on your data, and get the answer in the contract
• [ ] Check data retention, storage location and deletion on termination
• [ ] Review security evidence such as SOC 2 reports or ISO certifications
• [ ] Ask for model documentation: intended use, limitations, testing and known risks
• [ ] Require notice of material model changes and security incidents
• [ ] Sign data protection terms and, where relevant, business associate or similar agreements
• [ ] Use enterprise accounts with admin controls rather than personal accounts

Our guide to whether it is safe to put company data into AI goes deeper on vendor questions.

Checklist part 5: Monitoring and incident response

AI systems change after launch. Data shifts, vendors update models and people find new ways to use tools.

• [ ] Define 2 to 4 metrics per medium- or high-risk system (accuracy, error rate, fairness by group, complaint volume, override rate)
• [ ] Review metrics on a set schedule: monthly for high-risk, quarterly for medium
• [ ] Log inputs and outputs where legally and practically possible, so you can investigate problems
• [ ] Create a simple way for employees and customers to report AI problems
• [ ] Add AI incidents to your incident response plan, with criteria for pausing a system
• [ ] Re-review systems after major vendor updates, new data sources or new uses
• [ ] Report a short AI risk summary to leadership or the board at least twice a year

Where to start: the first 30 days

If you are starting from zero, do these in order:

1. Week 1: Appoint an executive sponsor and a review group. Send a short survey asking every team which AI tools they use.
2. Week 2: Build the register and assign an owner to each system. Flag anything touching sensitive data or decisions about people.
3. Week 3: Publish a one-page acceptable use policy and an approved tools list.
4. Week 4: Run a risk review on your top 3 highest-risk systems and set monitoring metrics for each.

Then expand quarter by quarter. If you are still deciding where AI fits in the business, pair this with our AI readiness checklist.

Conclusion

Good AI governance is less about paperwork and more about clarity: knowing what AI you run, who owns it, how risky it is and how you will know if it goes wrong. Start with an inventory and named owners, tier your risks, put your vendors under the same scrutiny as your own builds and keep monitoring. Borrow structure from NIST and ISO/IEC 42001 as you grow, and you will be ready for customer questionnaires, audits and new regulations without slowing your teams down.

Sources

• NIST AI Risk Management Framework — AI RMF 1.0 (January 2023) and its Govern, Map, Measure and Manage functions
• NIST AI 600-1: Generative AI Profile (July 2024) — risks specific to generative AI and suggested actions
• ISO/IEC 42001:2023 Artificial intelligence management system — certifiable AI management system standard published December 2023
• EUR-Lex: Regulation (EU) 2024/1689, the Artificial Intelligence Act — EU obligations for AI providers and deployers