MAST CONSULTING AI GOVERNANCE
AI Governance Policy — drafting guide

This is an original drafting aid, not an approved policy or an official standard. Tailor it to your organization and obtain appropriate approval.

1. Purpose: Explain the intended governance outcomes.
2. Scope: Define entities, systems, people and lifecycle stages covered.
3. Principles: Set expectations for accountability, transparency, security, privacy and human oversight.
4. Ownership: Define business, technical, risk and oversight responsibilities.
5. Inventory: Require AI registration, ownership and classification.
6. Assessments: Define risk and impact assessment triggers and review expectations.
7. Controls: Specify data, supplier, lifecycle and acceptable-use requirements.
8. Approval: Set decision rights, evidence requirements and exception routes.
9. Monitoring: Define indicators, incident reporting and escalation.
10. Assurance: Require training, audit, management review and improvement.
11. Document control: Record owner, approver, version, review date and supporting procedures.