- kickoff
- 2026-10-08
- target complete
- 2026-10-22
Harbor IT Services — fictional records
Completed example with unresolved work. No source documents or customer records are included.
Program timeline
AI Governance Policy and Charter
- wording
- Harbor IT Services records AI uses, assigns review owners and keeps unresolved evidence visible. Examples cover organizational decisions and records. The kit does not inspect tenants, scan endpoints or implement technical controls. Each client company needs its own license.
- owner
- Service operations lead
- evidence location
- Fictional draft charter
- last reviewed
- 2026-10-08
- s
- 1
Policy record
- owner
- Service operations lead
- adopted date
- 2026-10-08
- next review
- 2026-10-22
- review frequency
- Quarterly and on material changes
AI Acceptable Use Policy
No records yet. Follow-up remains open.
AI System and Use-Case Inventory
- System or use case
- SupportDraft
- Owner
- Service delivery manager
- Description and purpose
- Draft internal support articles from public vendor documentation
- Vendor or in-house
- Vendor
- Data used
- Public documentation and synthetic support tickets
- Personal or sensitive data
- No
- Population affected
- Staff
- Risk tier
- Limited
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Approved with conditions
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- TicketNote
- Owner
- Service delivery manager
- Description and purpose
- Summarize customer support tickets
- Vendor or in-house
- Vendor
- Data used
- Customer contacts, infrastructure details and possible credentials
- Personal or sensitive data
- Yes
- Population affected
- Staff
- Risk tier
- High
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Declined
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- CodeDraft
- Owner
- Service delivery manager
- Description and purpose
- Suggest internal scripts using synthetic test cases
- Vendor or in-house
- Vendor
- Data used
- Synthetic configuration examples with no secrets
- Personal or sensitive data
- No
- Population affected
- Staff
- Risk tier
- Limited
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Approved with conditions
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- WriteAssist
- Description and purpose
- Draft internal emails, agendas and process notes
- Data used
- Internal operational notes only; no client records or personal data
- Risk tier
- Low
- Inventory status
- Approved
- Owner
- Service operations lead
- Vendor or in-house
- Vendor
- Personal or sensitive data
- No
- Population affected
- Staff
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- ResearchBrief
- Description and purpose
- Summarize published articles and public guidance for internal briefings
- Data used
- Published sources only; summaries are checked against the source before reuse
- Risk tier
- Low
- Inventory status
- Approved with conditions
- Owner
- Service operations lead
- Vendor or in-house
- Vendor
- Personal or sensitive data
- No
- Population affected
- Staff
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
AI Use-Case Approval Form
- Requestor
- Service desk lead
- Team
- Service desk
- Date
- 2026-10-08
- Tool or use case
- SupportDraft
- Data it will touch
- Public documentation and synthetic support tickets
- Who is affected
- Staff
- Approved tools considered
- Manual drafting and source review
- Vendor risk assessment
- Not attached
- Proposed risk tier
- Limited
- Decision
- Approved with conditions
- Conditions
- Service delivery manager checks technical steps and removes customer identifiers; restricted to public or synthetic inputs pending supplier review.
- Reviewer
- Service delivery manager
- Business purpose
- Draft internal support articles from public vendor documentation
- Date needed
- 2026-10-22
- Requestor
- Service desk lead
- Team
- Service desk
- Date
- 2026-10-08
- Tool or use case
- TicketNote
- Data it will touch
- Customer contacts, infrastructure details and possible credentials
- Who is affected
- Staff
- Approved tools considered
- Continue the existing manual workflow
- Vendor risk assessment
- Not attached
- Proposed risk tier
- High
- Decision
- Declined
- Conditions
- Real-data pilot declined until permission and vendor review are complete.
- Reviewer
- Service delivery manager
- Business purpose
- Summarize customer support tickets
- Date needed
- 2026-10-22
- Requestor
- Engineering lead
- Team
- Engineering
- Date
- 2026-10-08
- Tool or use case
- CodeDraft
- Data it will touch
- Synthetic configuration examples with no secrets
- Who is affected
- Staff
- Approved tools considered
- Manual drafting and source review
- Vendor risk assessment
- Attached
- Proposed risk tier
- Limited
- Decision
- Approved with conditions
- Conditions
- Reason: vendor assessment attached and inputs limited to synthetic configuration examples with no secrets. Condition: Engineer tests changes in an isolated environment; customer execution needs separate approval.
- Reviewer
- Service delivery manager
- Business purpose
- Suggest internal scripts using synthetic test cases
- Date needed
- 2026-10-22
- Decision review date
- 2026-10-22
AI Risk Register
- Risk description
- A sample troubleshooting instruction has not been tested
- Related system or use case
- SupportDraft
- Category
- Operational
- Likelihood
- Medium
- Impact
- Medium
- Current controls
- Service delivery manager checks technical steps and removes customer identifiers
- Owner
- Service delivery manager
- Mitigation action
- Complete the review and record the outcome.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
- Risk description
- Ticket-field redaction and customer permission remain unverified
- Related system or use case
- TicketNote
- Category
- Data
- Likelihood
- Medium
- Impact
- High
- Current controls
- Customer owner and security lead confirm permitted fields and processing terms
- Owner
- Service delivery manager
- Mitigation action
- Pause the use and obtain the missing evidence.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
- Risk description
- Two contractors have not confirmed tools or connector permissions
- Related system or use case
- CodeDraft
- Category
- Operational
- Likelihood
- Medium
- Impact
- Medium
- Current controls
- Engineer tests changes in an isolated environment; customer execution needs separate approval
- Owner
- Service delivery manager
- Mitigation action
- Complete the review and record the outcome.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
Data Governance Standard for AI
- wording
- Classify inputs before use: public or synthetic material is distinct from confidential client records. Customer Alder prohibits uploading raw tickets, credentials and tenant exports. AI-generated changes require engineering review and the existing change-approval process.
- owner
- Service operations lead
- evidence location
- Fictional records / Harbor IT Services / E-1
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Use the minimum information needed for the recorded purpose; exclude unnecessary identifiers, credentials and unrelated client material.
- owner
- Service operations lead
- evidence location
- Fictional records / Harbor IT Services / E-2
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Customer contacts, infrastructure details and possible credentials require a specific review of permissions and safeguards before any approved processing.
- owner
- Service operations lead
- evidence location
- Fictional records / Harbor IT Services / E-3
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Service delivery manager must check vendor retention, deletion and training-use settings for the actual account. Unverified settings remain an open action.
- owner
- Service operations lead
- evidence location
- Fictional records / Harbor IT Services / E-1
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Service delivery manager checks technical steps and removes customer identifiers. Record corrections and unresolved checks before sharing output.
- owner
- Service operations lead
- evidence location
- Fictional records / Harbor IT Services / E-2
- last reviewed
- 2026-10-08
- s
- 1
Human Oversight and Escalation Procedure
No records yet. Follow-up remains open.
AI Incident Response Runbook
No records yet. Follow-up remains open.
Roles and Responsibilities (RACI)
No records yet. Follow-up remains open.
ISO 42001 Readiness Checklist
No records yet. Follow-up remains open.
Imported source records
No records yet. Follow-up remains open.