LEGAL GUIDE · AI GOVERNANCE
A responsible-AI quick scan before a new tool goes live.
The first governance question is not whether a system is “AI.” It is what decision the system influences, whose information it uses and what happens when the output is wrong.
1. Describe the use case without product language
Write one sentence explaining what the tool will do, who will use it and what decision follows. “Generative AI assistant” is not enough. “Drafts customer responses that an employee approves before sending” creates a different risk from “automatically rejects an applicant.”
2. Check the information and rights involved
- Will prompts contain confidential, personal or regulated information?
- Can the provider use inputs or outputs for training?
- Who owns generated content, and could third-party material appear in it?
- Does the system affect employment, credit, access, pricing or another consequential decision?
3. Set human responsibility
Name the person who approves the use, the person who monitors it and the person who can suspend it. “Human in the loop” is not a control unless the human has time, authority, information and a clear standard for intervention.
4. Examine the vendor relationship
- Review service descriptions, limitations and prohibited uses.
- Check security, data location, subcontractors and deletion.
- Identify audit, incident and change-notice commitments.
- Decide how data and work can be exported when the relationship ends.
5. Keep an approval record
Record the use case, owner, data, identified risks, required controls, testing and approval date. Define what change triggers a new review: a new model, new data, removal of human review or deployment to a different group. Governance should make low-risk use easier while creating friction where a decision can materially affect people or the business.
This scan is not a technical model audit. Performance, bias, security and robustness testing may require technical specialists alongside legal review.