AI Governance Checklist: 15 Questions Every Leadership Team Should Ask
AI governance can become complicated very quickly.
Policies.
Committees.
Risk registers.
Data controls.
Human oversight.
Model monitoring.
Security.
Approval processes.
Incident procedures.
Agent permissions.
Regulatory requirements.
All of these can matter.
But leadership teams do not necessarily need to begin by understanding every technical detail of AI governance.
They need to begin with something simpler:
Are the fundamental controls required to manage AI actually in place?
That requires leadership to look beyond whether the organisation has:
an AI policy;
an AI committee;
an approved technology platform.
Those things can be useful.
But none of them individually proves that AI is being governed effectively.
A stronger approach is to ask a series of practical questions about how AI actually operates across the organisation.
Here are 15 questions every leadership team should be able to answer.
1. Do we know where AI is being used?
This is the foundation.
You cannot govern AI you cannot see.
Leadership should have reasonable visibility of material AI use across:
business functions;
approved enterprise platforms;
embedded software;
third-party applications;
employee tools;
automated workflows;
AI agents.
This does not mean recording every employee prompt.
It means understanding where AI is being used in ways that could create material:
business value;
risk;
customer impact;
employee impact;
financial impact.
If the organisation cannot identify its material AI use cases, almost every other governance control becomes harder.
What evidence should leadership expect?
Depending on the organisation, evidence might include:
an AI use-case register;
approved-tool inventory;
technology discovery;
departmental reporting;
agent register.
The objective is material visibility, not surveillance.
For more on the risk created when AI adoption happens outside formal visibility, read Shadow AI and AI Governance: The Hidden Risk of Uncontrolled AI Use in Your Business.
2. Does every material AI use case have a named business owner?
Once AI use is visible, leadership needs to know:
Who owns it?
Not:
“Technology.”
Not:
“The AI committee.”
Not:
“The business.”
A named person or clearly defined role.
That owner should be accountable for the business outcome the AI affects.
Technical teams may enable the capability.
Risk functions may provide challenge.
Governance groups may provide oversight.
But business accountability should remain visible.
For more on why this matters, read Who Owns AI in Your Business? If the Answer Isn't Clear, You Have a Problem.
3. Have we classified AI use cases according to risk?
Not all AI requires the same level of governance.
An employee using AI to brainstorm internal ideas does not create the same potential consequence as AI influencing:
recruitment;
credit;
pricing;
customer eligibility;
financial transactions;
regulated decisions.
Leadership therefore needs a mechanism for determining:
which AI needs more control.
A useful risk assessment considers:
impact;
data;
decision-making;
autonomy;
reversibility;
exposure.
For the complete framework, read AI Risk Classification: How to Classify AI Use Cases by Risk.
4. Are our governance requirements proportionate to risk?
Classification should change what happens next.
If every AI use case follows exactly the same approval process, the organisation probably does not have risk-based governance.
Lower-risk AI should generally move faster.
Higher-risk AI should receive greater scrutiny.
A practical model is:
LOW RISK → ENABLE
MODERATE RISK → REVIEW
HIGH RISK → APPROVE
CRITICAL → ASSURE
This prevents governance becoming a bottleneck while ensuring leadership attention is concentrated where consequences are greatest.
5. Do employees know what AI they are allowed to use?
AI governance cannot exist only at executive level.
Employees need practical answers.
Which tools are approved?
Can I use AI with customer data?
Can I upload internal documents?
Can I use free AI tools?
Can AI produce customer-facing content?
Do I need to verify the output?
Where do I go if I am unsure?
A policy should make responsible AI use easier, not simply produce more rules.
For more on turning governance into practical organisational guidance, read How to Create an AI Governance Policy: A Practical Guide for Business Leaders.
6. Are AI decision rights clear?
Ownership and authority are different.
Someone may own an AI use case while another person has authority to:
approve it;
approve data access;
set human oversight;
increase permissions;
approve scale;
suspend the system.
Leadership should understand:
who can decide what.
Otherwise decisions either become inconsistent or continually escalate upwards.
For more on defining these authorities, read AI Decision Rights: Who Should Be Allowed to Approve, Override or Stop AI?
7. Is human oversight meaningful?
Many organisations say:
“There is a human in the loop.”
That does not necessarily mean effective oversight exists.
Ask:
Does the human understand what they are reviewing?
Do they have enough information?
Do they have enough time?
Can they genuinely disagree with the AI?
Can they override it?
Will they be penalised for doing so?
Are overrides monitored?
A human clicking Approve thousands of times may technically be in the loop while adding very little control.
For more on designing oversight properly, read Human Oversight in AI: When Does AI Need a Human in the Loop?
8. Do we know what data AI can access?
AI risk can change significantly depending on the information available to it.
Leadership needs appropriate visibility of whether AI can access:
personal data;
customer records;
employee information;
financial information;
contracts;
commercially sensitive information;
internal communications;
intellectual property.
The relevant questions include:
What data can the AI see?
Why does it need it?
Where is it processed?
Who can access the output?
Can the provider retain it?
Can the AI use information outside the intended purpose?
Data access should be intentional.
Not accidental.
9. Do AI systems have the minimum permissions they need?
This becomes particularly important with agents.
An agent that can read information creates one level of authority.
An agent that can:
update;
send;
purchase;
refund;
delete;
trigger other systems
creates another.
Leadership should therefore ask:
Does this AI have more authority than it actually needs?
The principle should be:
minimum necessary authority.
For more on determining appropriate agent authority, read How Much Autonomy Should You Give an AI Agent? A Practical Framework for Business Leaders.
10. Do we know when AI must escalate to a human?
AI should understand its boundaries.
Escalation triggers might include:
low confidence;
unusual circumstances;
financial thresholds;
sensitive decisions;
policy conflicts;
customer complaints;
unexpected behaviour;
regulated activity.
The objective is not to eliminate AI autonomy.
It is to establish where autonomy ends.
For more on how the relationship changes as AI moves from assistance towards action, read AI Assistants vs AI Agents: What Business Leaders Need to Know Before Giving AI Autonomy.
11. Are we monitoring what happens after AI goes live?
Approval is not the end of governance.
AI operates in changing environments.
Data changes.
Users change.
Processes change.
Models change.
Volumes increase.
Agents gain permissions.
Leadership therefore needs appropriate monitoring.
Depending on the use case, this could include:
performance;
accuracy;
exceptions;
human overrides;
complaints;
incidents;
cost;
adoption;
unexpected behaviour.
Higher-risk AI should generally receive stronger monitoring.
Governance needs to operate across the AI lifecycle, not simply before deployment.
12. Do we have a clear AI incident process?
Something will eventually go wrong.
Perhaps:
sensitive information is entered into the wrong system;
AI produces a harmful output;
an agent takes an unexpected action;
a customer receives incorrect information;
a security concern emerges;
an employee discovers inappropriate AI behaviour.
The organisation needs to know:
How is the issue reported?
Who investigates?
Who can suspend the AI?
Who needs to be informed?
How is impact assessed?
How is recurrence prevented?
Incident processes should be designed before an incident happens.
13. Can we stop an AI system quickly?
This is related to incidents but deserves its own question.
For every material AI system:
Who has stop authority?
And practically:
Can they actually stop it?
An organisation may have a policy saying a system can be suspended while technical architecture makes immediate intervention difficult.
Governance needs both:
decision authority
and
operational capability.
This becomes increasingly important as AI agents gain the ability to act across multiple systems.
14. Are we governing AI value as well as AI risk?
AI governance should not become purely defensive.
Leadership also needs to know:
Why are we using this AI?
What business outcome is expected?
Who owns the value?
Is adoption occurring?
Is measurable benefit emerging?
Should we continue investing?
Governance should help the organisation make better decisions, not simply reduce risk.
For more on assigning accountability for AI benefits, read Who Owns AI ROI? Why Every AI Investment Needs a Business Value Owner.
15. Can leadership see all of this in one place?
This may ultimately be the most important question.
Imagine the CEO asks:
“Show me our material AI activity.”
Can the organisation provide a coherent view of:
use cases;
owners;
investment;
risk;
decision rights;
controls;
agents;
adoption;
incidents;
value;
actions;
review dates?
Or does the information sit across:
spreadsheets;
emails;
PowerPoints;
policy documents;
technology systems;
different functions?
As AI activity scales, governance information itself needs to become manageable.
Leadership should not need six weeks of data gathering to understand the organisation's AI position.
This is where AI governance begins moving from documentation towards decision intelligence.
The Stratify AI Governance Control System
These 15 questions can be consolidated into seven governance capabilities:
VISIBILITY
What AI exists?
↓
OWNERSHIP
Who is accountable?
↓
CLASSIFICATION
How consequential is it?
↓
AUTHORITY
Who can decide what?
↓
CONTROL
What boundaries apply?
↓
MONITORING
Is it behaving as expected?
↓
RESPONSE
What happens when something changes or goes wrong?
So the Stratify AI Governance Control System becomes:
VISIBILITY → OWNERSHIP → CLASSIFICATION → AUTHORITY → CONTROL → MONITORING → RESPONSE
This is one of the core structures that should eventually sit underneath the Stratify Governance Assessment.
The AI Governance Evidence Test
For every material AI use case, leadership should ideally be able to produce evidence of:
VISIBILITY
The use case is registered.
OWNERSHIP
Named accountable owner.
RISK
Risk classification.
DECISION
Approval and decision authority.
CONTROL
Required safeguards.
OVERSIGHT
Human involvement where required.
MONITORING
Performance and exceptions.
VALUE
Expected business outcome.
RESPONSE
Escalation and stop authority.
REVIEW
When the use case will next be reassessed.
The objective is not paperwork.
It is to ensure governance is real rather than assumed.
What should the Board see?
The Board should not receive the entire AI register.
It needs an appropriately summarised view of material matters.
That might include:
highest-risk AI applications;
significant incidents;
major AI investments;
material changes in autonomy;
important regulatory developments;
unresolved governance gaps;
evidence of management oversight.
For more on the Board's role, read Board Oversight of AI: What Directors Actually Need to Know.
What should executive leadership see?
Executives need a more operational view.
For example:
material AI portfolio;
owners;
risk distribution;
investment;
governance actions;
agent authority;
adoption;
value;
incidents;
scale/change/pause/stop decisions.
This is where governance connects to the wider AI operating model.
For more on how these capabilities work together, read What Is an AI Operating Model? A Practical Guide for Leadership Teams.
Who should run the governance system?
Governance will usually involve multiple functions.
Business.
Technology.
Security.
Risk.
Legal.
Compliance.
Data.
HR.
Finance.
No single function has every answer.
But the operating model still needs coordination.
A CAIO, CIO, governance lead, transformation leader or Fractional CAIO may help coordinate the system.
The role is not to personally approve everything.
It is to ensure:
the process exists;
ownership is clear;
material issues are visible;
actions are followed through;
leadership receives appropriate information.
For more on structuring cross-functional responsibilities, read Is RACI Enough for AI? Building Accountability That Actually Works.
Governance should make safe AI easier
This is worth repeating.
Strong governance is not measured by:
number of policies;
number of committees;
number of approval forms;
number of people copied into an email.
It is measured by whether the organisation can:
identify AI;
understand consequence;
assign ownership;
make decisions;
apply controls;
monitor performance;
respond when necessary.
And do all of that without unnecessarily slowing low-risk, high-value AI adoption.
That is why governance maturity is ultimately about decision quality.
The 15-Question AI Governance Checklist
Leadership should be able to answer:
Do we know where material AI is being used?
Does every material AI use case have a named business owner?
Are AI use cases classified according to risk?
Are governance requirements proportionate to that risk?
Do employees know which AI tools and uses are permitted?
Are AI decision rights clear?
Is human oversight meaningful?
Do we know what data AI can access?
Are AI permissions limited appropriately?
Are escalation boundaries clear?
Is AI monitored after deployment?
Is there a defined AI incident process?
Can material AI systems be stopped quickly?
Is AI value governed alongside AI risk?
Can leadership see the organisation's material AI position in one place?
If leadership cannot confidently answer several of these questions, the organisation may have an AI governance gap.
The next step is not necessarily more policy.
It is identifying which governance capability is missing and what action closes the gap.
Frequently Asked Questions About AI Governance
What is an AI governance checklist?
An AI governance checklist is a structured set of questions used to assess whether an organisation has appropriate visibility, ownership, risk management, decision rights, controls, monitoring and incident processes around AI.
What should AI governance include?
AI governance can include AI inventories, policies, ownership, risk classification, decision rights, data controls, human oversight, agent permissions, monitoring, incident response and executive oversight.
How do you know if AI governance is effective?
Effective governance should allow leadership to identify material AI use, understand risk, know who owns outcomes, see which controls apply, monitor performance and intervene when necessary.
Does every AI use case need formal governance?
Governance should be proportionate. Low-risk uses may operate within approved policies and tools, while higher-risk or more autonomous AI generally requires stronger assessment, approval and monitoring.
Who is responsible for AI governance?
Responsibility is usually distributed across business, Technology, Risk, Legal, Security, Data and other functions, while accountability and decision rights should remain clearly assigned.
How should AI agents be governed?
AI agents require clear objectives, data and system permissions, authority limits, human oversight, escalation rules, monitoring and stop authority.
What should Boards know about AI governance?
Boards should have appropriate visibility of material AI strategy, risk, significant investment, major incidents and management's governance arrangements without becoming operational owners.
How often should AI governance be reviewed?
Governance should be reviewed periodically and when material changes occur in AI purpose, risk, data, scale, autonomy, regulation or organisational impact.
How Strong Is Your AI Governance?
AI governance needs to work in practice, not simply exist on paper.
Stratify's Executive AI Governance & Risk Assessment helps leadership teams identify gaps across:
Governance foundations
AI visibility
Risk classification
Ownership
Decision rights
Human oversight
Data, security and access
Monitoring
Incident response
Test Your AI Governance
Because the question isn't:
“Do we have AI governance?”
It is:
“Can we demonstrate that the AI that matters is visible, owned, controlled and monitored?”
Comments