{ "object_name": "AI Governance Checklist", "object_slug": "ai-governance-checklist", "version": "1.0", "last_reviewed": "2026-06-24", "owner": "LPM / Lapemo", "object_type": "LPM Knowledge Object", "primary_lpm_layers": [ "Governance Architecture" ], "connected_lpm_layers": [ "Ownership Map", "Decision Architecture", "Information Ecology", "Platform Structure", "Control Map", "Risk Acceptance Register", "AI Amplification" ], "purpose": "Use this AI Governance Checklist to decide whether an AI use case is safe, owned, evidenced, controlled, monitored, and ready to proceed. The checklist prevents AI work from moving forward as disconnected pilots, shadow automation, vendor enthusiasm, or executive theater. It ties each AI initiative to accountable ownership, decision rights, data boundaries, evidence standards, control coverage, human review, monitoring, and lifecycle governance.", "intended_audience": [ "Executives", "Transformation Leaders", "AI Governance Leaders", "Risk Leaders", "Compliance Leaders", "Legal Leaders", "Security Leaders", "Privacy Leaders", "Data Leaders", "Platform Owners", "Product Leaders", "Technology Leaders" ], "metadata": [ { "name": "Object type", "value": "LPM Knowledge Object" }, { "name": "Primary LPM layer", "value": "Governance Architecture" }, { "name": "Connected layers", "value": "Ownership Map, Decision Architecture, Information Ecology, Platform Structure, Control Map, Risk Acceptance Register, AI Amplification" }, { "name": "Primary use", "value": "Validate whether an AI initiative, model, agent, workflow, or AI-assisted operating process is governed enough to design, pilot, launch, scale, or retire." }, { "name": "Website use", "value": "Downloadable governance checklist, AI readiness resource, executive governance guide, JSON object for Lapemo ingestion, and future guided skill." }, { "name": "Version", "value": "1.0" }, { "name": "Owner", "value": "LPM / Lapemo" }, { "name": "Last reviewed", "value": "2026-06-24" } ], "core_principles": [ { "principle": "AI must have an accountable owner", "meaning": "Every AI use case, model, agent, workflow, prompt, or automation must have one accountable business owner and clear supporting technical, data, risk, and control owners." }, { "principle": "AI cannot outrun decision rights", "meaning": "AI may recommend, draft, retrieve, summarize, score, route, trigger, or act only within explicit decision rights and approval boundaries." }, { "principle": "Data boundaries are governance boundaries", "meaning": "AI must only use approved sources, approved data classes, defined retrieval scope, and clear source-of-truth rules." }, { "principle": "Evidence must beat confidence", "meaning": "AI confidence, fluent summaries, or model scores are not enough. Claims must connect to source, freshness, lineage, owner, and validation evidence." }, { "principle": "Human review must be designed, not assumed", "meaning": "Human-in-the-loop rules must specify who reviews, when review happens, what evidence is reviewed, and what authority the reviewer has." }, { "principle": "Controls must be mapped before scale", "meaning": "Controls, monitoring, logs, thresholds, overrides, escalation paths, and kill-switch ownership must be defined before AI impacts customers, employees, financials, compliance, or enterprise decisions." }, { "principle": "AI governance must be lifecycle-based", "meaning": "Governance does not stop at launch. AI use must be reviewed, monitored, updated, superseded, restricted, or retired as data, models, vendors, policies, and operating conditions change." } ], "required_fields": [ { "name": "AI use case ID", "definition": "Unique identifier for the AI initiative, model, agent, automation, workflow, prompt library, or AI-assisted process", "required": "Yes" }, { "name": "AI use case name", "definition": "Plain-language name of the AI use case or governed AI capability", "required": "Yes" }, { "name": "Business purpose", "definition": "Outcome, problem, decision, workflow, control, or customer/employee need the AI use case supports", "required": "Yes" }, { "name": "Accountable business owner", "definition": "Person or role accountable for outcomes, risk acceptance, value realization, and ongoing use", "required": "Yes" }, { "name": "Technical owner", "definition": "Person or role accountable for implementation, integration, reliability, logs, and operational health", "required": "Yes" }, { "name": "Data owner", "definition": "Person or role accountable for approved sources, data quality, sensitivity, access, lineage, and freshness", "required": "Yes" }, { "name": "Control owner", "definition": "Person or role accountable for controls, evidence, monitoring, testing, and exception handling", "required": "Yes" }, { "name": "Decision owner", "definition": "Person or forum with authority over AI-enabled decisions or recommendations", "required": "Yes" }, { "name": "AI type", "definition": "Assistant, copilot, classifier, summarizer, recommender, retrieval workflow, automation, model, agent, decision support, or autonomous action", "required": "Yes" }, { "name": "Impact tier", "definition": "Low, moderate, high, critical, regulated, customer-facing, employee-impacting, financial, security, privacy, or control-impacting", "required": "Yes" }, { "name": "Approved data sources", "definition": "Systems, documents, dashboards, data products, knowledge objects, repositories, and APIs the AI may use", "required": "Yes" }, { "name": "Blocked data sources", "definition": "Sources, sensitive data, unapproved systems, stale documents, private channels, or unsupported knowledge bases the AI may not use", "required": "Yes" }, { "name": "Allowed AI actions", "definition": "What AI is allowed to retrieve, draft, recommend, score, route, trigger, update, communicate, monitor, or execute", "required": "Yes" }, { "name": "Blocked AI actions", "definition": "What AI may not do without human approval, governance approval, or control validation", "required": "Yes" }, { "name": "Human review rule", "definition": "Reviewer, review trigger, review evidence, decision authority, override path, and exception handling", "required": "Yes" }, { "name": "Evidence requirement", "definition": "Sources, logs, tests, model cards, vendor documentation, policy references, validation results, and decision records required", "required": "Yes" }, { "name": "Control coverage", "definition": "Preventive, detective, corrective, access, privacy, security, compliance, model, vendor, and operational controls", "required": "Yes" }, { "name": "Monitoring signals", "definition": "Performance, drift, incidents, usage, adoption, false positives, false negatives, control failures, user feedback, and business value metrics", "required": "Yes" }, { "name": "Escalation path", "definition": "Where issues go when AI output is wrong, harmful, unauthorized, stale, risky, overused, or outside approved scope", "required": "Yes" }, { "name": "Risk acceptance link", "definition": "Accepted risk ID or explicit statement that no risk acceptance is required", "required": "Required for moderate and above" }, { "name": "Launch status", "definition": "Idea, discovery, design, pilot, limited release, production, scaled, restricted, paused, retired, or superseded", "required": "Yes" }, { "name": "Review cadence", "definition": "Weekly, monthly, quarterly, release-based, incident-based, policy-change based, vendor-change based, or data-change based", "required": "Yes" } ], "governance_domains": [ { "domain": "Business ownership", "purpose": "Confirms the AI use case has a real business owner, value case, accountable outcome, and funding path." }, { "domain": "Decision rights", "purpose": "Defines whether AI advises, drafts, routes, recommends, scores, approves, updates, or acts, and who has authority over each action." }, { "domain": "Data and knowledge boundaries", "purpose": "Defines approved sources, blocked sources, source-of-truth rules, sensitivity, access, freshness, and lineage." }, { "domain": "Model, vendor, and tool governance", "purpose": "Documents the AI tool, model, vendor, platform, version, terms, data handling, reliability, and lifecycle ownership." }, { "domain": "Human review and accountability", "purpose": "Defines required review, approval, override, exception, and escalation paths for AI-assisted work." }, { "domain": "Controls and evidence", "purpose": "Maps controls, logs, test evidence, evidence owners, auditability, monitoring, and control failure handling." }, { "domain": "Risk, legal, security, and privacy", "purpose": "Confirms required reviews for sensitive data, customer impact, employee impact, regulated decisions, IP, security, and privacy." }, { "domain": "Operational monitoring", "purpose": "Defines performance signals, drift monitoring, incidents, adoption, business value, user feedback, and retirement triggers." } ], "checklist_sections": [ { "section": "1. Business ownership and intent", "items": [ { "item": "Use case has one accountable business owner", "status": "Yes / No / Partial", "guidance": "Do not proceed without a named owner." }, { "item": "Business purpose is tied to a measurable outcome", "status": "Yes / No / Partial", "guidance": "Outcome should be specific enough to measure value or harm." }, { "item": "AI use case is connected to a workflow, decision, service, product, control, or operating-model need", "status": "Yes / No / Partial", "guidance": "Avoid standalone AI demos with no operating destination." }, { "item": "Funding, support, and lifecycle ownership are clear", "status": "Yes / No / Partial", "guidance": "Owner must cover sustainment, not just launch." } ] }, { "section": "2. Decision rights and action boundary", "items": [ { "item": "AI role is classified as retrieve, draft, summarize, recommend, score, route, trigger, update, or act", "status": "Yes / No / Partial", "guidance": "Classify the strongest action AI can take." }, { "item": "Decision owner is documented for every AI-influenced decision", "status": "Yes / No / Partial", "guidance": "AI cannot become the hidden decision owner." }, { "item": "Allowed AI actions are explicitly defined", "status": "Yes / No / Partial", "guidance": "Allowed actions must be narrower than tool capability." }, { "item": "Blocked AI actions are explicitly defined", "status": "Yes / No / Partial", "guidance": "Block approvals, commitments, external communications, financial actions, policy exceptions, or control bypass unless approved." }, { "item": "Escalation path exists when AI output conflicts with human judgment, policy, evidence, or controls", "status": "Yes / No / Partial", "guidance": "Conflicts should not be solved in side channels." } ] }, { "section": "3. Data, source, and knowledge boundary", "items": [ { "item": "Approved sources are named and owned", "status": "Yes / No / Partial", "guidance": "List systems, documents, dashboards, repositories, APIs, and knowledge objects." }, { "item": "Blocked sources and sensitive data classes are named", "status": "Yes / No / Partial", "guidance": "Include personal, confidential, regulated, stale, draft, private, and unsupported sources." }, { "item": "Source-of-truth rule is documented", "status": "Yes / No / Partial", "guidance": "Define what source wins when sources conflict." }, { "item": "Freshness window is defined for AI-readable knowledge", "status": "Yes / No / Partial", "guidance": "Stale knowledge should trigger warning, review, or blocked use." }, { "item": "Data lineage and evidence traceability are sufficient for the use case impact tier", "status": "Yes / No / Partial", "guidance": "Higher impact use cases need stronger lineage." } ] }, { "section": "4. Model, vendor, and platform governance", "items": [ { "item": "Model, vendor, tool, platform, and version are documented", "status": "Yes / No / Partial", "guidance": "Do not govern AI generically when the implementation has specific behavior." }, { "item": "Data handling, retention, training use, logging, and access terms are understood", "status": "Yes / No / Partial", "guidance": "Confirm vendor and enterprise terms." }, { "item": "Security, privacy, legal, procurement, and architecture review needs are classified", "status": "Yes / No / Partial", "guidance": "Do not assume all AI tools fit the same path." }, { "item": "Model limitations, known failure modes, and misuse risks are documented", "status": "Yes / No / Partial", "guidance": "Use plain language that owners can understand." } ] }, { "section": "5. Human review and operating control", "items": [ { "item": "Human review rule is specific", "status": "Yes / No / Partial", "guidance": "Name reviewer role, trigger, evidence, authority, and override path." }, { "item": "Control owner is documented", "status": "Yes / No / Partial", "guidance": "Control ownership cannot be split across everyone." }, { "item": "Preventive, detective, and corrective controls are mapped", "status": "Yes / No / Partial", "guidance": "At minimum define guardrails, logs, monitoring, and remediation." }, { "item": "Kill switch, pause rule, or rollback path exists", "status": "Yes / No / Partial", "guidance": "Critical AI use needs a clear stop path." } ] }, { "section": "6. Risk, compliance, and ethics review", "items": [ { "item": "Impact tier is assigned", "status": "Yes / No / Partial", "guidance": "Higher impact requires stronger review and evidence." }, { "item": "Customer, employee, financial, compliance, security, privacy, or regulatory impact is classified", "status": "Yes / No / Partial", "guidance": "Material impact changes the governance route." }, { "item": "Risk acceptance is documented if residual risk remains", "status": "Yes / No / Partial", "guidance": "Accepted risk must be explicit, owned, time-bound, and reviewed." }, { "item": "Bias, harm, misuse, overreliance, and explainability risks are considered", "status": "Yes / No / Partial", "guidance": "Use practical risk language, not theory only." } ] }, { "section": "7. Evidence, logs, and monitoring", "items": [ { "item": "Evidence package is complete enough for impact tier", "status": "Yes / No / Partial", "guidance": "Evidence should include source, tests, logs, approvals, validation, and operating assumptions." }, { "item": "Output validation method is documented", "status": "Yes / No / Partial", "guidance": "Define how wrong, incomplete, stale, or harmful outputs are detected." }, { "item": "Monitoring signals are defined", "status": "Yes / No / Partial", "guidance": "Track accuracy, drift, incidents, overrides, user feedback, adoption, value, and control failures." }, { "item": "Decision logs or audit records are produced where required", "status": "Yes / No / Partial", "guidance": "Critical AI decisions need replayability." } ] }, { "section": "8. Launch, scale, and lifecycle governance", "items": [ { "item": "Launch gate is defined", "status": "Yes / No / Partial", "guidance": "Idea, discovery, pilot, production, scaled, restricted, paused, or retired." }, { "item": "Scale criteria are defined before broad rollout", "status": "Yes / No / Partial", "guidance": "Pilot success does not automatically mean enterprise scale." }, { "item": "Review cadence and trigger conditions are documented", "status": "Yes / No / Partial", "guidance": "Review on incidents, data change, policy change, vendor change, model change, drift, and value degradation." }, { "item": "Retirement or supersession rule is documented", "status": "Yes / No / Partial", "guidance": "AI capabilities must be removable when unsafe, stale, redundant, or low value." } ] } ], "scale_versions": { "500+ employee company": [ { "dimension": "Design intent", "recommended_pattern": "Create a practical AI governance checkpoint that prevents unmanaged pilots while keeping review lightweight and fast." }, { "dimension": "Minimum scope", "recommended_pattern": "Track business owner, use case, approved sources, AI actions, human review, risks, controls, evidence, and launch status." }, { "dimension": "Operating pattern", "recommended_pattern": "A small cross-functional AI review group reviews moderate and high-impact use cases before pilot or production use." }, { "dimension": "AI focus", "recommended_pattern": "Focus on ownership, approved tool use, source boundaries, human review, and preventing shadow automation." }, { "dimension": "Governance need", "recommended_pattern": "Connect to ownership map, decision rights model, source-of-truth map, control map, and risk acceptance register." }, { "dimension": "Red flags", "recommended_pattern": "Teams use public AI tools without data rules, pilots have no owner, and leaders measure activity instead of business outcome." } ], "5,000+ employee company": [ { "dimension": "Design intent", "recommended_pattern": "Create federated AI governance where business units can move quickly inside enterprise policy, controls, evidence, and review rules." }, { "dimension": "Minimum scope", "recommended_pattern": "Add impact tiering, data classification, model/tool inventory, vendor review, logs, monitoring, escalation, and risk acceptance linkage." }, { "dimension": "Operating pattern", "recommended_pattern": "Business unit AI owners submit use cases through a common checklist, with routing to security, privacy, legal, data, risk, architecture, and governance as needed." }, { "dimension": "AI focus", "recommended_pattern": "Focus on preventing duplicate pilots, conflicting standards, unsafe integrations, weak evidence, and unsupported production AI." }, { "dimension": "Governance need", "recommended_pattern": "Connect to platform map, integration map, data lineage map, evidence checklist, decision log, and control map." }, { "dimension": "Red flags", "recommended_pattern": "Different functions create different AI rules, review is slow and unclear, and AI tools are approved without operational monitoring." } ], "10,000+ employee company": [ { "dimension": "Design intent", "recommended_pattern": "Create enterprise AI governance that can scale across business units, regions, vendors, regulated functions, shared platforms, and autonomous agents." }, { "dimension": "Minimum scope", "recommended_pattern": "Full lineage across use case, owner, model/tool, data, source, control, risk, decision, approval, logs, incidents, value, and retirement path." }, { "dimension": "Operating pattern", "recommended_pattern": "Central AI governance defines policy, risk tiering, standards, and control requirements while federated owners manage intake, evidence, monitoring, and lifecycle review." }, { "dimension": "AI focus", "recommended_pattern": "Focus on high-impact systems, external communication, employee or customer decisions, regulated workflows, agent action, sensitive data, and control bypass risk." }, { "dimension": "Governance need", "recommended_pattern": "Integrate with GRC, model risk, data governance, privacy, security, architecture, procurement, internal audit, enterprise risk, and executive governance." }, { "dimension": "Red flags", "recommended_pattern": "AI is embedded in workflows without traceability, vendors change models without review, agents act across systems without ownership, and audit cannot replay decisions." } ] }, "scoring_logic": [ { "dimension": "Business ownership", "score": "0-5", "good_state": "A real owner is accountable for purpose, outcome, risk, value, lifecycle, and escalation." }, { "dimension": "Decision boundary clarity", "score": "0-5", "good_state": "Allowed and blocked AI actions are explicit and tied to decision rights." }, { "dimension": "Data boundary strength", "score": "0-5", "good_state": "Approved sources, blocked sources, source-of-truth rules, sensitivity, lineage, and freshness are defined." }, { "dimension": "Model and vendor governance", "score": "0-5", "good_state": "Tool, model, version, vendor terms, limitations, failure modes, and lifecycle ownership are documented." }, { "dimension": "Human review design", "score": "0-5", "good_state": "Review triggers, reviewer role, evidence, approval authority, override path, and exception handling are clear." }, { "dimension": "Control coverage", "score": "0-5", "good_state": "Preventive, detective, corrective, access, privacy, security, operational, and AI controls are mapped." }, { "dimension": "Evidence strength", "score": "0-5", "good_state": "Evidence is current, sourced, owned, confidence-rated, testable, and sufficient for the impact tier." }, { "dimension": "Risk classification", "score": "0-5", "good_state": "Impact tier, residual risk, compliance obligations, risk acceptance, and escalation are clear." }, { "dimension": "Monitoring readiness", "score": "0-5", "good_state": "Performance, drift, incidents, usage, value, user feedback, and control failures are monitored." }, { "dimension": "Lifecycle discipline", "score": "0-5", "good_state": "Launch, scale, review, restriction, pause, retirement, and supersession rules are documented." } ], "readiness_classification": { "0-1.9": "Ungoverned or hidden AI activity", "2.0-3.4": "Documented but weak AI governance", "3.5-4.4": "Governed AI operating model", "4.5-5.0": "AI-ready governance architecture" }, "ai_prompts": [ "Classify this AI use case by impact tier, affected LPM layers, likely owners, required evidence, governance route, and allowed versus blocked AI actions.", "Review this AI governance checklist and identify missing ownership, weak evidence, unclear data boundary, missing controls, unresolved risk, and undefined human review.", "Given the AI use case description, generate the minimum governance evidence package required before pilot, production launch, or enterprise scale.", "Score this AI use case from 0 to 5 across business ownership, decision boundary clarity, data boundary strength, model and vendor governance, human review design, control coverage, evidence strength, risk classification, monitoring readiness, and lifecycle discipline.", "Determine whether this AI use case should proceed locally, require domain review, require enterprise governance, require executive approval, require risk acceptance, or be blocked.", "Convert this AI governance checklist into Lapemo objects for owner, use case, decision, data source, control, evidence, platform, integration, risk, monitoring signal, and AI boundary." ], "validation_rules": [ "Every AI use case must have one accountable business owner before pilot or launch.", "Every AI use case must classify AI role and strongest allowed action.", "Every AI use case must define allowed AI actions and blocked AI actions.", "Every AI use case must define approved data sources and blocked data sources.", "Every moderate, high, critical, regulated, customer-facing, employee-impacting, financial, security, privacy, or control-impacting use case must have documented human review.", "Every AI use case must have evidence requirements appropriate to its impact tier.", "Every AI use case must identify control owner, monitoring signals, escalation path, and stop or rollback path where material risk exists.", "Any residual risk must be linked to a risk acceptance register entry or explicitly marked as no acceptance required.", "AI cannot approve, commit, externalize, update systems of record, bypass controls, or make regulated decisions unless those actions are explicitly approved by governance.", "Production AI use must have review cadence, trigger conditions, lifecycle status, and retirement or supersession rule.", "Status must never be encoded only by color. Use labels such as idea, discovery, pilot, production, scaled, restricted, paused, retired, or superseded." ], "lapemo_ingestion_mapping": [ { "lapemo_object": "Knowledge object", "fields_or_entities": "AI Governance Checklist", "use": "Canonical reusable artifact for governance-layer AI review and operating control." }, { "lapemo_object": "AI use case object", "fields_or_entities": "Use case ID, name, purpose, AI type, impact tier, lifecycle status", "use": "Creates structured AI initiative records." }, { "lapemo_object": "Ownership object", "fields_or_entities": "Business owner, technical owner, data owner, control owner, decision owner, escalation owner", "use": "Connects AI to accountable owners." }, { "lapemo_object": "Decision object", "fields_or_entities": "Decision rights, allowed actions, blocked actions, approval authority, launch decision, scale decision", "use": "Connects AI use to decision architecture." }, { "lapemo_object": "Data object", "fields_or_entities": "Approved sources, blocked sources, sensitivity, lineage, freshness, source-of-truth rule", "use": "Controls what AI can retrieve or use." }, { "lapemo_object": "Control object", "fields_or_entities": "Preventive controls, detective controls, corrective controls, monitoring, failure handling, kill switch", "use": "Connects AI activity to governance controls." }, { "lapemo_object": "Evidence object", "fields_or_entities": "Evidence package, tests, logs, source, owner, freshness, confidence, approval record", "use": "Creates audit-ready proof." }, { "lapemo_object": "Platform object", "fields_or_entities": "AI tool, model, vendor, platform, integration, system of record, workflow", "use": "Connects AI governance to platform structure." }, { "lapemo_object": "Risk object", "fields_or_entities": "Impact tier, residual risk, risk acceptance link, compliance impact, privacy impact, security impact", "use": "Routes risk to the correct governance path." }, { "lapemo_object": "Monitoring object", "fields_or_entities": "Performance, drift, incidents, usage, adoption, business value, control failures, review triggers", "use": "Tracks whether AI remains safe and valuable after launch." } ], "render_targets": [ "DOCX", "PDF", "Markdown", "JSON", "Website download", "Lapemo guided skill", "In-app AI governance workflow" ] }