AI visibility
- List current AI tools and embedded AI features.
- Record owner, purpose, users, data and review date.
- Ask teams where public AI tools may already be used.
Practical checklist
AI Governance Checklist for Workplaces
A practical starter checklist for small businesses, charities, not-for-profits and workplaces adopting AI responsibly.
Start small
Map your AI tools, protect your data and train your people.
A simple checklist that staff understand is better than a complex process nobody follows.
Risk review
- Assess privacy, cyber security, bias, accuracy, safety and workforce impact.
- Identify high-risk use cases that need stronger approval.
- Check whether AI affects workers, customers, clients or vulnerable people.
Controls
- Set acceptable-use rules and prohibited uses.
- Apply access controls, record keeping and human review points.
- Plan incident reporting and escalation.
Training
- Train staff on safe prompting, data rules and hallucinations.
- Make managers aware of consultation and accountability expectations.
- Refresh training as tools and risks change.
Monitoring
- Track incidents, complaints, output quality and over-reliance.
- Review vendor changes and new AI features.
- Pause, improve or retire AI if controls no longer work.
High-risk AI use
Use stronger review when AI can affect people or important outcomes.
High-risk use includes AI that influences employment, safety, access to services, personal information, legal obligations, vulnerable people, financial outcomes, surveillance or significant customer decisions.
