AI governance evidence checklist

Start with scope and ownership

Before collecting files, define which AI system, workflow, business unit, and review period are in scope. An evidence list is most useful when each item has a clear owner and a reason it supports the assessment.

• System inventory: system name, purpose, business use, model or vendor, version, deployment context, and affected workflows.
• Accountability: business owner, technical owner, decision-makers, escalation contacts, and who approves material changes.
• Boundaries: intended users, data sources, regions, downstream systems, excluded uses, and third-party responsibilities.
• Review record: assessment date, review cadence, material changes since the last review, and open actions.

Collect evidence across the AI lifecycle

Use the checklist below as a starting point. The right evidence depends on the system's purpose, risk, and context; not every item applies to every organization.

Governance and approvals

• AI policies, operating procedures, roles, and approval criteria relevant to the system.
• Records showing who reviewed the use case, what was approved, and any conditions or exceptions.
• Risk acceptance, escalation, and change-control records with a named decision owner.

Risk, impact, and data

• Use-case description, intended benefits, affected groups, foreseeable misuse, and known limitations.
• Data provenance, permitted use, quality checks, privacy/security review, and retention practices where applicable.
• Risk analysis and chosen mitigations, including residual risks that remain for human review.

Evaluation and operation

• Evaluation plans, test results, validation criteria, and documented interpretation of results.
• Human oversight procedures: what people review, when they can intervene, and how exceptions are handled.
• Monitoring signals, incident and complaint handling, and the process for responding to performance or risk changes.
• Training, deployment, and model/vendor change records that affect the system's behavior or use.

Make the evidence reviewable

• Map each record to the system, control, owner, and review period it supports.
• Use current versions and record when each item was approved or last updated.
• Explain gaps and unavailable evidence instead of marking an item complete without support.
• Limit access to sensitive material; redact personal or confidential information when it is not needed for the review.
• Record findings, decisions, action owners, and target dates so the review leads to accountable follow-up.

This checklist helps teams prepare for a structured AI Governance readiness review. AICS reviews supporting evidence and identifies findings and priorities within the agreed assessment scope.