- kickoff
- 2026-10-08
- target complete
- 2026-10-22
Cedar Cloud Software — fictional records
Completed example with unresolved work. No source documents or customer records are included.
Program timeline
AI Governance Policy and Charter
- wording
- Cedar Cloud Software records AI uses, assigns review owners and keeps unresolved evidence visible. Examples focus on employee AI use. Customer-facing AI features need separate architecture, model evaluation and data-processing evidence.
- owner
- Engineering operations lead
- evidence location
- Fictional draft charter
- last reviewed
- 2026-10-08
- s
- 1
Policy record
- owner
- Engineering operations lead
- adopted date
- 2026-10-08
- next review
- 2026-10-22
- review frequency
- Quarterly and on material changes
AI Acceptable Use Policy
No records yet. Follow-up remains open.
AI System and Use-Case Inventory
- System or use case
- CodeDraft
- Owner
- Engineering manager
- Description and purpose
- Generate test ideas for an internal utility
- Vendor or in-house
- Vendor
- Data used
- Synthetic fixtures and public example code
- Personal or sensitive data
- No
- Population affected
- Staff
- Risk tier
- Limited
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Approved with conditions
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- SupportDraft
- Owner
- Engineering manager
- Description and purpose
- Draft responses from customer support tickets
- Vendor or in-house
- Vendor
- Data used
- Customer contacts, logs and possible secrets
- Personal or sensitive data
- Yes
- Population affected
- Staff
- Risk tier
- High
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Declined
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- DocsDraft
- Owner
- Engineering manager
- Description and purpose
- Draft documentation from public product information
- Vendor or in-house
- Vendor
- Data used
- Published release notes and synthetic examples
- Personal or sensitive data
- No
- Population affected
- Staff
- Risk tier
- Limited
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Inventory status
- Approved with conditions
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- WriteAssist
- Description and purpose
- Draft internal emails, agendas and process notes
- Data used
- Internal operational notes only; no client records or personal data
- Risk tier
- Low
- Inventory status
- Approved
- Owner
- Engineering operations lead
- Vendor or in-house
- Vendor
- Personal or sensitive data
- No
- Population affected
- Staff
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
- System or use case
- ResearchBrief
- Description and purpose
- Summarize published articles and public guidance for internal briefings
- Data used
- Published sources only; summaries are checked against the source before reuse
- Risk tier
- Low
- Inventory status
- Approved with conditions
- Owner
- Engineering operations lead
- Vendor or in-house
- Vendor
- Personal or sensitive data
- No
- Population affected
- Staff
- Frameworks in scope
- Internal working assessment only; not a regulatory classification
- Last review
- 2026-10-08
- Next review due
- 2026-10-22
AI Use-Case Approval Form
- Requestor
- Engineering lead
- Team
- Engineering
- Date
- 2026-10-08
- Tool or use case
- CodeDraft
- Data it will touch
- Synthetic fixtures and public example code
- Who is affected
- Staff
- Approved tools considered
- Manual drafting and source review
- Vendor risk assessment
- Not attached
- Proposed risk tier
- Limited
- Decision
- Approved with conditions
- Conditions
- Engineering manager reviews generated code, dependencies and test results before merge; restricted to public or synthetic inputs pending supplier review.
- Reviewer
- Engineering manager
- Business purpose
- Generate test ideas for an internal utility
- Date needed
- 2026-10-22
- Requestor
- Support lead
- Team
- Support
- Date
- 2026-10-08
- Tool or use case
- SupportDraft
- Data it will touch
- Customer contacts, logs and possible secrets
- Who is affected
- Staff
- Approved tools considered
- Continue the existing manual workflow
- Vendor risk assessment
- Not attached
- Proposed risk tier
- High
- Decision
- Declined
- Conditions
- Real-data pilot declined until permission and vendor review are complete.
- Reviewer
- Engineering manager
- Business purpose
- Draft responses from customer support tickets
- Date needed
- 2026-10-22
- Requestor
- Product lead
- Team
- Product
- Date
- 2026-10-08
- Tool or use case
- DocsDraft
- Data it will touch
- Published release notes and synthetic examples
- Who is affected
- Staff
- Approved tools considered
- Manual drafting and source review
- Vendor risk assessment
- Attached
- Proposed risk tier
- Limited
- Decision
- Approved with conditions
- Conditions
- Reason: vendor assessment attached and inputs limited to published release notes and synthetic examples. Condition: Product owner checks actual behavior and avoids unsupported security or AI claims.
- Reviewer
- Engineering manager
- Business purpose
- Draft documentation from public product information
- Date needed
- 2026-10-22
- Decision review date
- 2026-10-22
AI Risk Register
- Risk description
- A suggested dependency still needs provenance and license review
- Related system or use case
- CodeDraft
- Category
- Operational
- Likelihood
- Medium
- Impact
- Medium
- Current controls
- Engineering manager reviews generated code, dependencies and test results before merge
- Owner
- Engineering manager
- Mitigation action
- Complete the review and record the outcome.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
- Risk description
- Customer-data processing and log redaction are not yet verified
- Related system or use case
- SupportDraft
- Category
- Data
- Likelihood
- Medium
- Impact
- High
- Current controls
- Support and security owners confirm permitted fields and retention before use
- Owner
- Engineering manager
- Mitigation action
- Pause the use and obtain the missing evidence.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
- Risk description
- Two contractors have not confirmed personal assistants or repository connections
- Related system or use case
- DocsDraft
- Category
- Operational
- Likelihood
- Medium
- Impact
- Medium
- Current controls
- Product owner checks actual behavior and avoids unsupported security or AI claims
- Owner
- Engineering manager
- Mitigation action
- Complete the review and record the outcome.
- Due date
- 2026-10-22
- Status
- Mitigating
- Accepted by and why
- Not recorded
Data Governance Standard for AI
- wording
- Classify inputs before use: public or synthetic material is distinct from confidential client records. Buyer Alder separates staff-tool use from product AI features. Responses about a product feature remain unresolved until engineering supplies architecture, data-flow and evaluation evidence.
- owner
- Engineering operations lead
- evidence location
- Fictional records / Cedar Cloud Software / E-1
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Use the minimum information needed for the recorded purpose; exclude unnecessary identifiers, credentials and unrelated client material.
- owner
- Engineering operations lead
- evidence location
- Fictional records / Cedar Cloud Software / E-2
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Customer contacts, logs and possible secrets require a specific review of permissions and safeguards before any approved processing.
- owner
- Engineering operations lead
- evidence location
- Fictional records / Cedar Cloud Software / E-3
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Engineering manager must check vendor retention, deletion and training-use settings for the actual account. Unverified settings remain an open action.
- owner
- Engineering operations lead
- evidence location
- Fictional records / Cedar Cloud Software / E-1
- last reviewed
- 2026-10-08
- s
- 1
- wording
- Engineering manager reviews generated code, dependencies and test results before merge. Record corrections and unresolved checks before sharing output.
- owner
- Engineering operations lead
- evidence location
- Fictional records / Cedar Cloud Software / E-2
- last reviewed
- 2026-10-08
- s
- 1
Human Oversight and Escalation Procedure
No records yet. Follow-up remains open.
AI Incident Response Runbook
No records yet. Follow-up remains open.
Roles and Responsibilities (RACI)
No records yet. Follow-up remains open.
ISO 42001 Readiness Checklist
No records yet. Follow-up remains open.
Imported source records
No records yet. Follow-up remains open.