How large does our organization need to be to need AI governance?

If more than one team is building AI features, you need governance. The goal is consistency. Even small organizations benefit from a lightweight governance checklist that ensures every AI feature gets a risk assessment and basic review before launch. Scale the formality of the process to match your team size.

Who should own the AI governance policy?

The policy owner should be someone with cross-functional authority, typically the VP of Product, CTO, or a dedicated AI/ML leader. The key requirement is that this person can enforce the policy across engineering, product, and legal teams. Avoid assigning ownership to a single function, since governance requires input from multiple disciplines.

How does AI governance relate to existing data governance?

AI governance extends data governance with AI-specific concerns: model training data provenance, algorithmic fairness, automated decision-making rights, and model lifecycle management. Your existing data governance policies (retention, access control, consent) apply to AI systems. This template adds the layers needed for model-specific risks. The [AI PM Handbook](/ai-guide) covers the relationship between data strategy and AI product development in detail.

What happens when teams disagree on the risk tier?

When there is disagreement, escalate to the Governance Board for a final classification. Document the rationale for the decision. A useful default rule: if any single risk factor qualifies as Tier 3, classify the entire feature as Tier 3. It is better to over-classify and streamline the review process than to under-classify and discover gaps after launch.

How do we handle AI governance for third-party AI services (OpenAI, Anthropic, etc.)?

Third-party AI services still require governance review. Your risk classification should consider: what data you send to the provider, what the provider's data retention and training policies are, what SLAs and liability terms apply, and whether the provider's safety practices meet your standards. Treat third-party model APIs as a dependency that requires its own review process, similar to how you evaluate any critical vendor. The [AI vendor evaluation template](/templates/ai-vendor-evaluation-template) provides a structured approach for this assessment.

AI Governance Template

What This Template Is For

Shipping AI features without a governance structure is like deploying software without access controls. It works fine until it does not. As organizations add AI capabilities across multiple products, the need for consistent policies around risk assessment, review processes, accountability, and compliance becomes urgent. Without governance, teams make inconsistent decisions about acceptable AI behavior, data usage, and safety thresholds.

This template helps product leaders and engineering managers establish a practical AI governance framework. It covers organizational accountability, risk classification tiers, review workflows, compliance mapping, and monitoring requirements. The AI PM Handbook provides deeper context on AI product strategy, while the responsible AI glossary entry defines the core principles that governance should enforce. For hands-on assessment of your current governance posture, try the AI Governance Assessment tool. If you need to evaluate specific AI features for ethical risks, the AI Ethics Scanner complements this governance framework with feature-level analysis.

When to Use This Template

Your organization is deploying its first AI-powered product feature
Multiple teams are building AI features independently and making inconsistent decisions
You need to comply with AI regulations (EU AI Act, NIST AI RMF, ISO 42001)
Leadership has asked for a formal AI governance policy
An AI incident has exposed gaps in your current review processes

How to Use This Template

Fill in the Governance Structure section with your organization's decision makers
Customize the Risk Classification tiers to match your industry and risk tolerance
Define the Review Process workflows with specific reviewers and approval thresholds
Map applicable compliance requirements from regulations relevant to your industry
Set up the Monitoring and Audit section with concrete cadences and owners
Circulate the completed document to all AI stakeholders for feedback before ratifying

The Template

# AI Governance Policy

**Organization**: [Company Name]
**Effective Date**: [Date]
**Policy Owner**: [Name and Title]
**Review Cadence**: [Quarterly / Semi-annually / Annually]
**Version**: [1.0]

---

## 1. Governance Structure

### AI Governance Board
| Role | Name | Responsibility |
|------|------|---------------|
| Executive Sponsor | [CTO/CPO] | Final approval on high-risk AI deployments |
| AI Product Lead | [Name] | Owns product-level AI decisions and prioritization |
| AI/ML Engineering Lead | [Name] | Owns model selection, training, and deployment |
| Legal/Compliance | [Name] | Reviews regulatory compliance and liability |
| Data Privacy Officer | [Name] | Reviews data usage, retention, and consent |
| Ethics Advisor | [Name, or "Rotating"] | Reviews fairness, bias, and societal impact |

### Decision Authority Matrix
| Decision Type | Tier 1 (Low Risk) | Tier 2 (Medium Risk) | Tier 3 (High Risk) |
|--------------|-------------------|---------------------|-------------------|
| Feature approval | Product Lead | AI Product Lead + Legal | Governance Board |
| Model selection | Engineering Lead | Engineering Lead + Product Lead | Governance Board |
| Data source approval | Data Privacy Officer | Data Privacy Officer + Legal | Governance Board |
| Production deployment | Engineering Lead | AI Product Lead | Governance Board |
| Incident response | On-call engineer | Engineering Lead + Product Lead | Governance Board |

---

## 2. Risk Classification

### Tier Definitions

**Tier 1: Low Risk**
- AI is used for internal tools or non-customer-facing features
- Outputs are informational only (no automated decisions)
- No personal data is processed by the model
- Examples: [Internal search, content tagging, code suggestions for developers]

**Tier 2: Medium Risk**
- AI outputs influence customer-facing experiences
- Model processes personal but non-sensitive data
- Outputs assist human decision-makers (human remains in the loop)
- Examples: [Product recommendations, email draft suggestions, support ticket routing]

**Tier 3: High Risk**
- AI makes automated decisions affecting users (access, pricing, eligibility)
- Model processes sensitive data (health, financial, biometric)
- Errors could cause financial harm, discrimination, or safety issues
- Examples: [Credit scoring, hiring screening, medical triage, autonomous actions]

### Risk Assessment Checklist

For each new AI feature, answer these questions to determine the risk tier:

- [ ] Does the AI make autonomous decisions without human review? (Yes = Tier 2+)
- [ ] Could incorrect outputs cause financial harm to users? (Yes = Tier 3)
- [ ] Does the model process sensitive personal data? (Yes = Tier 3)
- [ ] Could outputs discriminate against protected groups? (Yes = Tier 3)
- [ ] Is the AI customer-facing? (Yes = Tier 2+)
- [ ] Could the AI be used for purposes beyond its intended scope? (Yes = Tier 2+)
- [ ] Are outputs used to make legal or employment decisions? (Yes = Tier 3)

---

## 3. Review Process

### Pre-Development Review (Required for Tier 2+)
- [ ] AI use case documented with clear problem statement
- [ ] Risk tier assigned using the classification checklist
- [ ] Data requirements reviewed by Data Privacy Officer
- [ ] Bias risk assessment completed
- [ ] Appropriate reviewers identified and notified

### Pre-Launch Review (Required for All Tiers)
- [ ] Model performance meets documented benchmarks
- [ ] Evaluation dataset includes demographic diversity
- [ ] Fallback behaviors tested and verified
- [ ] User-facing AI disclosures implemented
- [ ] Monitoring and alerting configured
- [ ] Incident response plan documented
- [ ] Rollback procedure tested

### Post-Launch Review (Cadence by Tier)
| Tier | Review Cadence | Reviewer | Focus Areas |
|------|---------------|----------|-------------|
| Tier 1 | Quarterly | Engineering Lead | Performance drift, cost |
| Tier 2 | Monthly | AI Product Lead + Engineering | Accuracy, bias, user feedback |
| Tier 3 | Bi-weekly | Governance Board | All metrics, compliance, incidents |

---

## 4. Data Governance for AI

### Acceptable Data Sources
| Data Category | Allowed for Training | Allowed for Inference | Restrictions |
|--------------|---------------------|----------------------|-------------|
| Public data | Yes | Yes | Verify licensing terms |
| First-party user data | With consent | With consent | Anonymize where possible |
| Synthetic data | Yes | Yes | Validate representativeness |
| Third-party licensed data | Per license terms | Per license terms | Document license scope |
| Sensitive personal data | Governance Board only | Governance Board only | Encryption, access controls, audit trail |

### Data Retention for AI
- **Training data**: Retained for [duration] after model is retired
- **Inference logs**: Retained for [duration], anonymized after [duration]
- **User feedback data**: Retained for [duration], available for deletion requests
- **Model artifacts**: Retained for [duration] after decommissioning

### User Rights
- [ ] Users can opt out of AI-powered features
- [ ] Users can request deletion of their data from training sets
- [ ] Users can access information about how AI affects their experience
- [ ] Users can contest AI-generated decisions (Tier 3)

---

## 5. Compliance Mapping

| Regulation/Standard | Applicability | Key Requirements | Status |
|---------------------|--------------|-----------------|--------|
| EU AI Act | [Yes/No/Partial] | Risk classification, transparency, human oversight | [Compliant / In Progress / Gap] |
| NIST AI RMF | [Yes/No/Partial] | Govern, Map, Measure, Manage lifecycle | [Compliant / In Progress / Gap] |
| ISO 42001 | [Yes/No/Partial] | AI management system certification | [Compliant / In Progress / Gap] |
| GDPR (AI provisions) | [Yes/No/Partial] | Automated decision-making rights, data protection | [Compliant / In Progress / Gap] |
| SOC 2 (AI controls) | [Yes/No/Partial] | AI-specific security and availability controls | [Compliant / In Progress / Gap] |
| Industry-specific | [Specify] | [Specify requirements] | [Status] |

---

## 6. Incident Management

### AI Incident Classification
| Severity | Definition | Response Time | Notification |
|----------|-----------|---------------|-------------|
| Critical | AI causes harm, discrimination, or data breach | Immediate | Governance Board + Legal |
| High | AI produces consistently incorrect outputs at scale | 4 hours | AI Product Lead + Engineering Lead |
| Medium | AI quality degrades below acceptable thresholds | 24 hours | Engineering Lead |
| Low | Isolated incorrect output reported by user | Next business day | Product team |

### Incident Response Steps
1. **Detect**: Automated monitoring or user report
2. **Contain**: Disable AI feature or route to fallback
3. **Investigate**: Root cause analysis (model, data, or system)
4. **Remediate**: Fix, retrain, or replace model
5. **Review**: Post-incident review with Governance Board
6. **Document**: Add to incident log and update governance policy if needed

### Incident Log Template
| Date | Severity | Description | Root Cause | Resolution | Policy Update Needed |
|------|----------|-------------|-----------|-----------|---------------------|
| [Date] | [S1-S4] | [What happened] | [Why] | [What was done] | [Yes/No] |

---

## 7. Monitoring and Audit

### Continuous Monitoring
| Metric | Frequency | Owner | Alert Threshold |
|--------|-----------|-------|----------------|
| Model accuracy | Daily | ML Engineering | Drop > [X]% from baseline |
| Bias metrics | Weekly | Ethics Advisor | Variance > [X]% across groups |
| Cost per inference | Daily | Engineering Lead | Exceed $[X] per request |
| User complaint rate | Weekly | Product Lead | Exceed [X] complaints per week |
| Data drift | Weekly | ML Engineering | Distribution shift > [X] threshold |

### Audit Schedule
- **Monthly**: Review monitoring dashboards and incident log
- **Quarterly**: Full governance policy review and update
- **Annually**: External audit of AI systems (Tier 3 only)
- **On-demand**: Post-incident review within 48 hours

Filled Example

Here is a partial example for a B2B SaaS company deploying AI-powered features:

# AI Governance Policy

**Organization**: Acme Analytics Inc.
**Effective Date**: 2026-03-01
**Policy Owner**: Sarah Chen, VP of Product
**Review Cadence**: Quarterly
**Version**: 1.0

## 1. Governance Structure

### AI Governance Board
| Role | Name | Responsibility |
|------|------|---------------|
| Executive Sponsor | James Rivera, CTO | Final approval on high-risk AI deployments |
| AI Product Lead | Sarah Chen, VP Product | Owns product-level AI decisions |
| AI/ML Engineering Lead | Priya Patel, Staff Engineer | Owns model selection and deployment |
| Legal/Compliance | Mark Thompson, General Counsel | Reviews regulatory compliance |
| Data Privacy Officer | Lisa Wong, DPO | Reviews data usage and consent |
| Ethics Advisor | Rotating (quarterly) | Reviews fairness and societal impact |

## 2. Risk Classification

**Current AI Features by Tier:**
- Tier 1: Dashboard data summarization, internal knowledge base search
- Tier 2: Customer churn prediction alerts, email draft suggestions
- Tier 3: Automated pricing recommendations, credit risk scoring

Key Takeaways

Every AI feature needs a risk tier classification before development begins
High-risk AI deployments require Governance Board approval, not just engineering sign-off
Data governance for AI must address training data provenance, user consent, and deletion rights
Incident classification and response procedures prevent ad hoc reactions to AI failures
Compliance mapping should be a living document reviewed quarterly as regulations evolve
Monitoring must cover accuracy, bias, cost, and data drift on a continuous basis

AI Governance Template