Who should fill in the checklist?

Whoever owns operations or IT, ideally with one or two people who use AI every day. Their answers are usually more accurate than leadership's guesses.

How long does it take to fix the gaps?

Most small organizations can close questions 1 to 4 in a couple of weeks: a survey, a policy, an owner and a move to business accounts. Training and reviews follow.

Is this checklist enough for compliance?

It covers good everyday practice, not legal compliance. If you handle regulated information, like health or children's data, check your obligations with a qualified advisor.

AI governance checklist: 10 questions for any organization

By Rafael · Updated November 1, 2026 · 3 min read

The short answer

Ten questions tell you where you stand: Do you know which AI tools are in use? Is there a policy and an owner? Are tools on business accounts? Does a person review AI work and decisions about people? Is AI labeled when the public sees it? Is your team trained, and is there a review date? Each "no" has a quick, practical fix.

The checklist

1. Do we know every AI tool in use?Good: an up-to-date AI register, including free tools and AI built into software we already use. Fix: run a no-blame survey and build an AI register.
2. Do we have a written AI policy?Good: one or two pages that staff have read. Fix: adapt our AI policy template.
3. Does one person own AI decisions?Good: a named owner who approves new tools and keeps the register current. Fix: name one this week; what AI governance is explains the role, and an AI governance RACI makes everyone's part clear.
4. Is work information only in business accounts?Good: no customer, donor, member or staff details in free personal accounts. Fix: move that work to a business plan, or remove personal details first. See is it safe to put business data in AI?
5. Is training on our data turned off?Good: confirmed in settings or by contract for every tool. Fix: see how to stop AI training on your data.
6. Does a person review AI work before it goes out?Good: facts, names and numbers checked before anything reaches customers or the public. Fix: write it into the policy and model it from the top.
7. Do people make decisions about people?Good: AI may help prepare, but a person decides on hiring, eligibility, discipline or care, notes how AI was used, and the AI has been checked for bias. Fix: mark these uses "approved with limits" and run a bias test.
8. Do we tell people when they're dealing with AI?Good: AI chat tools and mostly AI-written public content are labeled, with a way to reach a person. Fix: add a short label and a contact link.
9. Has our team been trained?Good: everyone who uses AI has had practical training on the policy. Fix: an hour of practice on real work; see how to train your team on AI.
10. Is there a review date?Good: the register and policy are reviewed at least every six months, with a short update to leaders. Fix: put the date in the policy now, and use a one-page board briefing.

How to score yourself

Count your clear "yes" answers. Eight to ten: you're well governed; keep it current. Five to seven: you're on the way; fix the gaps in the order above. Four or fewer: start with questions 1 to 4 this month. They remove most of the risk.

Prefer a guided version? The free AI governance kit asks these questions, rates each AI tool and gives you a readiness score with next steps.

Self-check vs. a full AI governance audit

These ten questions cover the basics, and answering them honestly puts you ahead of most organizations. A full audit goes further:

Evidence for every answer, not just a yes or no, so your board, funders or customers can check it.
Every AI tool rated with reasons in an AI register, including the ones staff don't mention (shadow AI).
The newer risks: AI agents acting on your behalf, prompt injection, and voice-clone or deepfake payment scams (what to watch for).
Bias testing wherever AI affects people.
A tailored AI policy, team training, a prioritized action plan and a one-page board briefing, each versioned so changes are tracked.

Start free: run the AI governance kit for your readiness score, AI register and draft policy in about 15 minutes. Want the full audit, done with your team? See AI governance with GrowDaily.

Common questions

Who should fill in the checklist?: Whoever owns operations or IT, ideally with one or two people who use AI every day. Their answers are usually more accurate than leadership's guesses.
How long does it take to fix the gaps?: Most small organizations can close questions 1 to 4 in a couple of weeks: a survey, a policy, an owner and a move to business accounts. Training and reviews follow.
Is this checklist enough for compliance?: It covers good everyday practice, not legal compliance. If you handle regulated information, like health or children's data, check your obligations with a qualified advisor.