AI Governance overview

Fernhill Wholesale · Fictional sample

Picture of the AI Governance Toolkit dashboard: follow-ups at 1 of 6, the Weekly stock summary assistant record approved with conditions, and one completed follow-up. — Picture of the dashboard. Fictional sample. The working sample opens on a desktop or laptop browser.

Read the report

Email myself a link for my computer

Need a different kit? Compare all samples

extrasphere.

AI Governance Toolkit

Please open this kit on a computer.

Paid kits require a desktop or laptop browser. They cannot be completed on a phone or tablet.

You can still browse the kit details on this device.

Email yourself a reminder to open it on your computer.

View kit details

Your program, made visible.

Browse Fernhill Wholesale’s fictional records, then see the report they support. Nothing to fill in.

What needs a decision

This fictional example records working facts and open follow-up notes. Review the evidence and owner decisions before relying on any entry.

Operations, sales and warehouse, an 18-person wholesaler · Put the AI tools staff already use on record, decide what each may touch, and give the owners a short leadership report by October 15, 2026.
Example review date: September 26, 2026

AI System and Use-Case Inventory: 6
Sections reviewed by preparer: 17/18
Section follow-up notes: 16
Evidence references: 33

Next actions

Named owners, clear next steps and visible gaps.

Action	Next step	Owner	Due	Status
NOTE-1	Six AI uses documented, including one declined request. Ask the warehouse and sales teams about any other tools by October 15; no use sends anything to customers without a person checking it.	Confirm with section owner	Not yet recorded	Needs review
NOTE-2	Three decisions recorded: the weekly stock summary approved with conditions (fictional decision FW-DEC-001), product descriptions approved, and the personal voice-note app declined. Reassess before any customer or payment details are used.	Confirm with section owner	Not yet recorded	Needs review
NOTE-3	Six checks reviewed against fictional evidence FW-VEN-001. The contract review for customer data remains open; the office manager to resolve by October 15.	Confirm with section owner	Not yet recorded	Needs review
NOTE-4	Fictional assessment accepts the weekly stock summary with a person checking the totals, not automatic reordering. Confirm the checks at the October 15 review.	Confirm with section owner	Not yet recorded	Needs review
NOTE-5	Three active risks require follow-up; none is closed. The operations manager reviews the actions weekly.	Confirm with section owner	Not yet recorded	Needs review
NOTE-6	Purpose agreed for the first uses; the full charter is still a draft. Owners sign off before it goes to all staff.	Confirm with section owner	Not yet recorded	Needs review
NOTE-7	Policy adopted October 8, 2026, after the owners reviewed it. Staff acknowledgment is due October 15.	Confirm with section owner	Not yet recorded	Needs review
NOTE-8	Office and warehouse leads briefed. Staff acknowledgment and the briefing for temporary warehouse staff remain due on October 15.	Confirm with section owner	Not yet recorded	Needs review
NOTE-9	Deletion settings for the approved assistant need a checked test by October 15. No customer or payment details go into any tool before that review.	Confirm with section owner	Not yet recorded	Needs review
NOTE-10	Review and stop path agreed. Walk the operations and sales leads through stopping a tool and escalating by October 8.	Confirm with section owner	Not yet recorded	Needs review
NOTE-11	Run a short incident walk-through on October 8. Who tells customers and when needs the owners’ sign-off before wider use.	Confirm with section owner	Not yet recorded	Needs review
NOTE-12	One fictional correction made before a summary was shared. Add the check-the-totals lesson to the staff briefing; no actual customer incident is represented.	Confirm with section owner	Not yet recorded	Needs review
NOTE-13	Six assignments accepted. Confirm the training owner and cover for temporary warehouse staff by October 1.	Confirm with section owner	Not yet recorded	Needs review
NOTE-14	Complete the first working program by October 10, leaving five days for the owners’ review. Quarterly review due December 15.	Confirm with section owner	Not yet recorded	Needs review
NOTE-15	Milestones 4, 5 and 9 complete: six uses inventoried, risk tiers set and all 12 readiness items reviewed. 1–3 await staff acknowledgment of the adopted policy; 6 awaits purchasing integration; 7 has a limited impact review but no high-impact use is authorized; 8 awaits the walk-through; 10 is scheduled for October 10. Blank completion dates mean work is not complete.	Confirm with section owner	Not yet recorded	Needs review
NOTE-16	All 12 readiness items assessed: 2 in place and 10 partial. Priorities: collect staff acknowledgments of the adopted policy, finish asking teams about tools, confirm the supplier contract, run the walk-through and complete staff training. This is a fictional self-assessment, not certification.	Confirm with section owner	Not yet recorded	Needs review

Every name, record and outcome in this example is invented. Counts describe this working set; they are not a compliance score.

Open a working area to see the details behind the report.

Program Timeline2 records

Two dates drive the pace tracker and the target clock: when you started, and your target for the first two weeks of rollout.

Kickoff date 2026-09-26

First two weeks target 2026-10-10

AI Governance Policy and Charter6 records

Track each commitment of the charter to In force with an owner and evidence location. Replace every bracketed field, delete the guidance notes, and have counsel review before rollout. Nothing here is legal advice.

Purpose Fernhill Wholesale decides which AI tools staff may use through named owners, recorded decisions and a person checking the results. The first uses cover internal summaries and catalog drafts.

Status: In force
Owner: Operations director
Evidence location: Fictional evidence / FW-POL-001 / charter section 1
Last reviewed: 2026-09-26

Principles We put customer trust, accuracy, care with personal information and clear accountability first. Staff report anything they are unsure about and stop a tool that looks unsafe.

Status: In progress
Owner: Operations director
Evidence location: Fictional evidence / FW-POL-001 / charter section 2
Last reviewed: 2026-09-26

Scope This policy covers all 18 staff, including temporary warehouse staff, using AI for Fernhill work. It excludes decisions about people, payment details and anything sent to customers without a person checking it.

Status: In progress
Owner: Operations director
Evidence location: Fictional evidence / FW-POL-001 / charter section 3
Last reviewed: 2026-09-26

Governance body The operations director sponsors the program. Operations, sales and the office manager meet monthly; contract questions go to the owners before approval.

Status: In progress
Owner: Operations director
Evidence location: Fictional evidence / FW-POL-001 / charter section 4
Last reviewed: 2026-09-26

Decision tiers Internal drafts from stock figures or published information need a named owner and a check by that owner. Customer details, payment information or decisions about people need the owners’ approval first.

Status: In progress
Owner: Operations director
Evidence location: Fictional evidence / FW-POL-001 / charter section 5
Last reviewed: 2026-09-26

Review The operations manager reviews the policy quarterly and after an incident, a supplier change or a new use. Next review is December 15, 2026.

Status: In progress
Owner: Operations director
Evidence location: Fictional evidence / FW-POL-001 / charter section 6
Last reviewed: 2026-09-26

Policy Record4 records

Name the charter owner and set the review cadence. The next review date feeds the deadline clock.

Owner Operations director

Review cadence Quarterly

Adopted on 2026-10-08

Next review 2026-12-15

AI Acceptable Use Policy5 records

This is the document every employee acknowledges. It is the day-to-day rulebook. Track each rule to In force with an owner and evidence of publication and acknowledgment.

Approved use Only tools on the approved list in the shared Operations folder may be used for Fernhill work. Summaries and catalog drafts are checked by a person before use.

Status: In force
Owner: Operations manager
Evidence location: Fictional evidence / FW-AUP-001 / item 1
Last reviewed: 2026-09-26

Prohibited use No customer names, contact details, payment information, pretending to be someone else or sending AI text to customers unchecked. Get approval before using a tool for anything new.

Status: In force
Owner: Operations manager
Evidence location: Fictional evidence / FW-AUP-001 / item 2
Last reviewed: 2026-09-26

Data Use stock figures, supplier specifications and Fernhill’s own photos in the approved tools. Customer emails are drafted from order numbers and delivery status only.

Status: In force
Owner: Operations manager
Evidence location: Fictional evidence / FW-AUP-001 / item 3
Last reviewed: 2026-09-26

Oversight The person who owns each use checks accuracy and suitability before an AI-assisted draft is shared or published. Staff remain accountable for what they send.

Status: In force
Owner: Operations manager
Evidence location: Fictional evidence / FW-AUP-001 / item 4
Last reviewed: 2026-09-26

Reporting Report a possible data exposure or a harmful output straight away to the office manager; stop using the tool while it is checked.

Status: In progress
Owner: Operations manager
Evidence location: Fictional evidence / FW-AUP-001 / item 5
Last reviewed: 2026-09-26

AI System and Use-Case Inventory6 records

List one AI use at a time. Capture its owner, purpose and information boundary first. Record approvals before the use goes live, then add review dates.

Weekly stock summary assistant Operations manager

Description and purpose: Draft a one-page summary of low stock, late deliveries and reorder suggestions for the Monday team meeting.
Vendor or in-house: Vendor
Data used: Product codes, stock counts and supplier delivery dates; no customer names, contact details or payment information.
Personal or sensitive data: No
Population affected: Staff
Risk tier: Limited
Frameworks in scope: Fernhill AI use rules; NIST AI RMF (Govern, Map)
Vendor assessment: Done
Vendor assessment: where it is kept (optional): Shared drive › Suppliers › FW-VEN-001 vendor review (fictional)
Inventory status: Approved with conditions
Conditions reported in source: Not yet recorded
Evidence: Not yet recorded
Approved by (source): Not yet recorded
Approved without a vendor assessment: reason: Not yet recorded
Last review: 2026-09-26
Next review due: 2026-12-15

Customer email reply drafts Customer service lead

Description and purpose: Draft replies to order and delivery questions for a person to check and send.
Vendor or in-house: Vendor
Data used: Order numbers and delivery status; customer names and contact details removed before drafting.
Personal or sensitive data: Yes
Population affected: Staff
Risk tier: Limited
Frameworks in scope: Fernhill privacy and retention rules
Vendor assessment: Not yet recorded
Vendor assessment: where it is kept (optional): Not yet recorded
Inventory status: Approved with conditions
Conditions reported in source: Not yet recorded
Evidence: Not yet recorded
Approved by (source): Not yet recorded
Approved without a vendor assessment: reason: Not yet recorded
Last review: 2026-09-26
Next review due: 2026-10-15

Catalog photo cleanup Sales and marketing lead

Description and purpose: Remove backgrounds and straighten product photos for the online catalog before a person checks each one.
Vendor or in-house: Vendor
Data used: Fernhill’s own product photos only; no people, customer premises or supplier logos.
Personal or sensitive data: No
Population affected: Staff
Risk tier: Limited
Frameworks in scope: Fernhill AI use rules
Vendor assessment: Not yet recorded
Vendor assessment: where it is kept (optional): Not yet recorded
Inventory status: Approved with conditions
Conditions reported in source: Not yet recorded
Evidence: Not yet recorded
Approved by (source): Not yet recorded
Approved without a vendor assessment: reason: Not yet recorded
Last review: 2026-09-26
Next review due: 2026-12-15

Product description writer Sales and marketing lead

Description and purpose: Draft online catalog descriptions from published supplier specification sheets.
Vendor or in-house: Vendor
Data used: Published supplier specifications only; a person checks sizes, materials and prices before a listing goes live.
Personal or sensitive data: No
Population affected: Public
Risk tier: Low
Frameworks in scope: Fernhill AI use rules
Vendor assessment: Not yet recorded
Vendor assessment: where it is kept (optional): Not yet recorded
Inventory status: Approved
Conditions reported in source: Not yet recorded
Evidence: Not yet recorded
Approved by (source): Not yet recorded
Approved without a vendor assessment: reason: Not yet recorded
Last review: 2026-09-26
Next review due: 2026-12-15

Supplier quote comparison Purchasing lead

Description and purpose: Compare supplier quotes line by line and flag price changes for the purchasing lead.
Vendor or in-house: Vendor
Data used: Supplier quotes with supplier names replaced by codes; no customer information.
Personal or sensitive data: No
Population affected: Staff
Risk tier: Limited
Frameworks in scope: Fernhill AI use rules
Vendor assessment: Not yet recorded
Vendor assessment: where it is kept (optional): Not yet recorded
Inventory status: Approved with conditions
Conditions reported in source: Not yet recorded
Evidence: Not yet recorded
Approved by (source): Not yet recorded
Approved without a vendor assessment: reason: Not yet recorded
Last review: 2026-09-26
Next review due: 2026-11-15

Voice-note transcriber (personal account) Sales representative

Description and purpose: Record and transcribe calls with customers and suppliers for follow-up notes.
Vendor or in-house: Vendor
Data used: Customer and supplier calls, names, voices and price discussions.
Personal or sensitive data: Yes
Population affected: Customers
Risk tier: High
Frameworks in scope: Fernhill privacy and retention rules
Vendor assessment: Not yet recorded
Vendor assessment: where it is kept (optional): Not yet recorded
Inventory status: Declined
Conditions reported in source: Not yet recorded
Evidence: Not yet recorded
Approved by (source): Not yet recorded
Approved without a vendor assessment: reason: Not yet recorded
Last review: 2026-09-26
Next review due: 2026-10-22

AI Use-Case Approval Form3 records

Intake for any new AI tool or use case before it goes live. One row per request. Do not begin company use until approved, and add approved entries to the Inventory.

Sales representative Sales

Date: 2026-09-22
Tool or use case: Voice-note transcriber (personal account)
Data it will touch: Customer and supplier calls, names, voices and price discussions.
Who is affected: Customers
Approved tools considered: Written call notes in the order system.
Vendor risk assessment: Not attached
Approved without a vendor assessment: reason: Not yet recorded
Proposed risk tier: High
Decision: Declined
Conditions: Declined. Calls are not recorded with AI until the people on the call agree and a retention period is set. Delete existing recordings on the personal account.
Reviewer: Operations director
Business purpose: Not yet recorded
Date needed: Not yet recorded
Decision review date: Not yet recorded

Sales and marketing lead Sales and marketing

Date: 2026-09-24
Tool or use case: Product description writer
Data it will touch: Published supplier specifications only.
Who is affected: Public
Approved tools considered: Manual copywriting.
Vendor risk assessment: Attached
Approved without a vendor assessment: reason: Not yet recorded
Proposed risk tier: Low
Decision: Approved
Conditions: Catalog descriptions only. A person checks sizes, materials and prices before each listing goes live.
Reviewer: Operations director
Business purpose: Not yet recorded
Date needed: Not yet recorded
Decision review date: Not yet recorded

Operations manager Operations

Date: 2026-09-26
Tool or use case: Weekly stock summary assistant
Data it will touch: Product codes, stock counts and supplier delivery dates. No customer or payment information.
Who is affected: Staff
Approved tools considered: Manual summary from the stock system.
Vendor risk assessment: Attached
Approved without a vendor assessment: reason: Not yet recorded
Proposed risk tier: Limited
Decision: Approved with conditions
Conditions: Internal summaries only; the operations manager checks the totals against the stock system before the summary is shared.
Reviewer: Operations director
Business purpose: Not yet recorded
Date needed: Not yet recorded
Decision review date: Not yet recorded

AI Vendor and Third-Party Risk Assessment1 record

Complete before adopting any third-party AI tool that touches company or client data. One row per assessment: open the checks on each row to work through the seven areas, then record the overall rating, the recommendation, and a reassess-by date.

Lumen Works — fictional supplier Lumen Enterprise Assistant — simulated

Assessed by: Office manager
Date: 2026-09-26
Overall rating: Medium risk
Recommendation: Adopt with conditions
Conditions: Fictional test record: business account; training disabled in scenario; short retention; no customer or payment data until the owners review the contract.
Reassess by: 2026-12-15
Data handling: true
Security posture: true
Sub-processors: true
Contract terms: true
Vendor requirements: Not yet recorded
Reliability and exit: true
Model Governance: true
Data handling — answer / evidence: Fictional FW-VEN-001 records account training disabled, data region and 30-day retention; stock figures only for now.
Security posture — answer / evidence: The office manager reviewed a fictional supplier assurance summary and account settings on September 26; no real vendor certification claimed.
Sub-processors — answer / evidence: Fictional processing chain and region reviewed; supplier change notices go to the office manager.
Contract terms — answer / evidence: Fictional business terms reviewed for internal stock summaries. Customer data needs a further contract review.
Vendor requirements — answer / evidence: Open: the office manager must confirm where data is stored and the contract terms before any customer data is added.
Reliability and exit — answer / evidence: The manual summary from the stock system remains available. Export and deletion steps documented in FW-EXIT-001.
Model Governance — answer / evidence: Supplier change log and known limitations reviewed in fictional FW-MODEL-001; re-check the summary after major updates.

AI Impact Assessment1 record

Run for any high-impact use: customer-facing, sensitive data, or decisions about people. One row per assessment: open the checks to work through the assessment steps, then record the residual risk decision, the approver, and a review-due date.

Weekly stock summary assistant Operations manager

Date: 2026-09-26
Residual risk decision: Acceptable with conditions
Conditions: The operations manager checks the totals against the stock system before sharing. Stock figures only; nothing is reordered automatically.
Approver: Operations director
Review due: 2026-10-15
Purpose and context: true
Affected people: true
Potential harms: true
Fairness: true
Transparency: true
Human oversight: true
Mitigations: true
Purpose and context — answer / evidence: An internal weekly summary; helps the operations team plan reorders without placing orders or contacting anyone. FW-IMP-001.
Affected people — answer / evidence: Operations and warehouse staff; no employment, credit, health or eligibility decisions.
Potential harms — answer / evidence: Wrong totals leading to a missed or doubled reorder: medium likelihood and impact. See risk register.
Fairness — answer / evidence: No decisions about people. The summary covers stock and deliveries only; checked monthly in fictional FW-TEST-001.
Transparency — answer / evidence: The team knows the summary is AI-drafted and checked. Questions go to the operations manager.
Human oversight — answer / evidence: The operations manager checks every summary against the stock system before it is shared. Nothing is ordered automatically.
Mitigations — answer / evidence: Stock figures only, a monthly comparison with the stock system, restricted access and a weekly check; owners recorded in the risk register.

AI Risk Register3 records

Central log of identified AI risks. Owned by the governance group and reviewed at each meeting. One row per risk. Where a risk is accepted rather than mitigated, record who accepted it and why.

The weekly summary shows wrong totals and a reorder is missed or doubled. Weekly stock summary assistant

Category: Legal
Likelihood: Medium
Impact: High
Current controls: The operations manager checks the totals against the stock system before sharing; nothing is ordered automatically.
Owner: Operations manager
Mitigation action: Compare one summary a month with the stock system and record any differences.
Due date: 2026-10-08
Status: Mitigating
Accepted by and why: Not accepted without the weekly check; internal summaries approved with a person reviewing them.

Staff paste customer names or payment details into an unapproved AI tool. All AI tools at Fernhill

Category: Data
Likelihood: Medium
Impact: High
Current controls: Stock figures and published information only in approved tools; business accounts only.
Owner: Office manager
Mitigation action: Ask each team which tools they use, publish the approved list and brief all 18 staff.
Due date: 2026-10-15
Status: Open
Accepted by and why: Not accepted. Stop any unapproved use involving customer or payment details.

Call recordings made on a personal account before the request was declined have not been found or deleted. Voice-note transcriber (personal account)

Category: Data
Likelihood: Medium
Impact: High
Current controls: Request declined; no further recording on personal accounts.
Owner: Sales manager
Mitigation action: Confirm what was recorded, delete the copies with the sales representative and record the deletion.
Due date: 2026-10-22
Status: Open
Accepted by and why: Not accepted.

Actions3 records

Assign a concrete next step to an owner and, when relevant, link it to an AI use. Record completion only after reviewing the evidence.

The dashboard's follow-up count also includes mitigation steps from the AI Risk Register.

ACT-1 Compare one summary a month with the stock system and record any differences.

Owner: Operations manager
Due date: Oct 8, 2026
Status: Completed
Completion evidence reference: Fictional example: completion note filed with the review records

ACT-2 Ask each team which tools they use, publish the approved list and brief all 18 staff.

Owner: Office manager
Due date: Oct 15, 2026
Status: In progress
Completion evidence reference: Not yet recorded

ACT-3 Confirm what was recorded, delete the copies with the sales representative and record the deletion.

Owner: Sales manager
Due date: Oct 22, 2026
Status: Planned
Completion evidence reference: Not yet recorded

Data Governance Standard for AI6 records

Sets the rules for how data is used with AI at Fernhill Wholesale. Track each rule to In force with an owner and evidence.

Classification Sort information into public, internal, customer and payment. The approved assistant takes stock figures and published information only; customer emails use order numbers and delivery status.

Status: In force
Owner: Office manager
Evidence location: Fictional evidence / FW-DATA-001 / item 1
Last reviewed: 2026-09-26

Minimization Remove names, contact details, account numbers and supplier prices that are not needed before any permitted AI use. Use made-up examples when testing.

Status: In force
Owner: Office manager
Evidence location: Fictional evidence / FW-DATA-001 / item 2
Last reviewed: 2026-09-26

Personal data No payment details in any AI tool. The owners approve any new use of customer personal information first.

Status: In force
Owner: Office manager
Evidence location: Fictional evidence / FW-DATA-001 / item 3
Last reviewed: 2026-09-26

Vendor retention The office manager checks training, storage location and retention settings before a tool is added and after major updates. Record the settings in the supplier review.

Status: In progress
Owner: Office manager
Evidence location: Fictional evidence / FW-DATA-001 / item 4
Last reviewed: 2026-09-26

Outputs Treat AI output as an unchecked draft until the owner checks the facts, figures and suitability. Output keeps the same classification as its source.

Status: In force
Owner: Office manager
Evidence location: Fictional evidence / FW-DATA-001 / item 5
Last reviewed: 2026-09-26

Retention and deletion Keep AI records in the shared Operations folder. Delete temporary prompts and drafts on the agreed schedule; record the supplier’s deletion check when a tool is retired.

Status: In progress
Owner: Office manager
Evidence location: Fictional evidence / FW-DATA-001 / item 6
Last reviewed: 2026-09-26

Human Oversight and Escalation Procedure4 records

A human is accountable for every consequential AI output. AI assists; it does not decide alone. Track each control to In force with an owner and evidence.

Review points The operations manager checks every weekly summary against the stock system before it is shared. Record the check in the weekly log.

Status: In force
Owner: Operations manager
Evidence location: Fictional evidence / FW-OVR-001 / item 1
Last reviewed: 2026-09-26

Override Any reviewer may reject or rewrite AI output. The customer service lead may hold a reply until it is clarified; record why and the follow-up.

Status: In force
Owner: Operations manager
Evidence location: Fictional evidence / FW-OVR-001 / item 2
Last reviewed: 2026-09-26

Escalation path Stock and catalog issues go to the operations manager; data or account concerns go straight to the office manager; contract questions go to the owners and the operations director.

Status: In force
Owner: Operations manager
Evidence location: Fictional evidence / FW-OVR-001 / item 3
Last reviewed: 2026-09-26

Stop conditions Stop the tool for a possible customer-data exposure, wrong or unsafe output, or use beyond the approved scope. Restart only after the responsible lead records that it is cleared.

Status: In progress
Owner: Operations manager
Evidence location: Fictional evidence / FW-OVR-001 / item 4
Last reviewed: 2026-09-26

AI Incident Response Runbook6 records

Follow when an AI system causes or risks harm: a data exposure, a seriously wrong or harmful output, or misuse. Track each step of the runbook to In place with a named owner, and log real incidents below as they happen.

Detect and report Report a possible incident straight away to the office manager; a possible exposure of customer data also needs a call to the operations director.

Status: In place
Owner: Office manager
Notes: Fictional runbook FW-IR-001, step 1. Contacts and responsibilities confirmed.

Contain Stop the affected tool, remove access where needed and keep the relevant records without spreading customer information.

Status: In place
Owner: Office manager
Notes: Fictional runbook FW-IR-001, step 2. Contacts and responsibilities confirmed.

Assess The office manager works out which data, people, customers, outputs and systems are affected. Record the severity and escalation decisions in the incident log.

Status: In place
Owner: Office manager
Notes: Fictional runbook FW-IR-001, step 3. Contacts and responsibilities confirmed.

Notify The owners decide who must be told, including customers and suppliers, and by when. Record who was told, the deadline and the message agreed.

Status: In progress
Owner: Office manager
Notes: Fictional runbook FW-IR-001, step 4. Walk-through and owner review due October 8; not yet fully in place.

Remediate Correct or withdraw the affected output, close the gap and name an action owner. Check the fix before the operations director agrees to restart.

Status: In progress
Owner: Office manager
Notes: Fictional runbook FW-IR-001, step 5. Walk-through and owner review due October 8; not yet fully in place.

Review Review what happened within five working days. Update the staff briefing, supplier reviews and checks, and keep a record of what changed.

Status: In progress
Owner: Office manager
Notes: Fictional runbook FW-IR-001, step 6. Walk-through and owner review due October 8; not yet fully in place.

Incident and Override Log1 record

Log incidents, overrides, and escalations as they happen. As part of remediation, update controls, the Inventory, and the Risk Register.

2026-09-26 2026-09-26

Type: Override
Event: FICTIONAL TRIAL: The operations manager found a doubled stock count in a weekly summary before it was shared. Totals corrected from the stock system; nothing was ordered. Evidence FW-INC-001.
Resolved: true

Roles and Responsibilities (RACI)7 records

Adapt roles to your organization. R = does the work, A = accountable, C = consulted, I = informed. Mark each activity Assigned once its owner has accepted it.

Set AI policy A: Operations director; R: Operations manager; C: Office manager and owners; I: All staff.

Status: Assigned
Owner: Operations director
Notes: Fictional responsibility record FW-RACI-001, item 1. Role accepted on September 26.

Approve high-impact use cases A: Operations director; R: Use owner; C: Office manager and owners; I: Sales and warehouse leads.

Status: Assigned
Owner: Operations director
Notes: Fictional responsibility record FW-RACI-001, item 2. Role accepted on September 26.

Maintain the inventory A: Operations director; R: Operations manager; C: Team leads and the office manager; I: All staff.

Status: Assigned
Owner: Operations manager
Notes: Fictional responsibility record FW-RACI-001, item 3. Role accepted on September 26.

Assess vendors A: Operations director; R: Office manager; C: Owners and purchasing; I: Tool owners.

Status: Assigned
Owner: Office manager
Notes: Fictional responsibility record FW-RACI-001, item 4. Role accepted on September 26.

Run impact assessments A: Operations director; R: Operations manager; C: Office manager and sales and marketing lead; I: Operations team.

Status: Assigned
Owner: Operations manager
Notes: Fictional responsibility record FW-RACI-001, item 5. Role accepted on September 26.

Handle incidents A: Operations director; R: Office manager; C: Owners and sales manager; I: Affected staff through an agreed message.

Status: Assigned
Owner: Office manager
Notes: Fictional responsibility record FW-RACI-001, item 6. Role accepted on September 26.

Train staff A: Operations director; R: Warehouse supervisor; C: Operations manager and office manager; I: All staff and temporary warehouse staff.

Status: Proposed
Owner: Warehouse supervisor
Notes: Fictional responsibility record FW-RACI-001, item 7. Training owner proposed; obtain acceptance by October 1.

ISO 42001 Readiness Checklist12 records

A quick self-assessment. Mark each: in place, partial, or missing.

Leadership has assigned ownership for AI governance In place

Owner: Operations director
Evidence location: Fictional evidence / FW-RACI-001 / sponsor appointment
Last reviewed: 2026-09-26

A written AI policy exists and is communicated Partial

Owner: Operations manager
Evidence location: Fictional evidence / FW-POL-001 / draft charter awaiting sign-off
Last reviewed: 2026-09-26

AI uses and systems are inventoried Partial

Owner: Operations manager
Evidence location: Fictional evidence / FW-INV-001 / six uses; teams still being asked about other tools
Last reviewed: 2026-09-26

Risks are identified, assessed, and logged Partial

Owner: Operations manager
Evidence location: Fictional evidence / FW-RISK-001 / two active risk actions
Last reviewed: 2026-09-26

Impact assessments run for high-impact uses Partial

Owner: Operations manager
Evidence location: Fictional evidence / FW-IMP-001 / stock summary assessment; wider use blocked
Last reviewed: 2026-09-26

Third-party AI tools are risk-assessed Partial

Owner: Office manager
Evidence location: Fictional evidence / FW-VEN-001 / six checks; contract review pending
Last reviewed: 2026-09-26

Human oversight is defined for consequential outputs In place

Owner: Operations manager
Evidence location: Fictional evidence / FW-OVR-001 / review and stop decisions
Last reviewed: 2026-09-26

Data governance rules cover AI use Partial

Owner: Office manager
Evidence location: Fictional evidence / FW-DATA-001 / input rules; retention test pending
Last reviewed: 2026-09-26

An incident process exists and is tested Partial

Owner: Office manager
Evidence location: Fictional evidence / FW-IR-001 / draft runbook; walk-through due October 8
Last reviewed: 2026-09-26

Staff receive AI awareness and competence support Partial

Owner: Warehouse supervisor
Evidence location: Fictional evidence / FW-TRAIN-001 / leads briefed only; wider training pending
Last reviewed: 2026-09-26

The program is reviewed on a set cycle Partial

Owner: Operations director
Evidence location: Fictional evidence / FW-REVIEW-001 / quarterly review scheduled December 15
Last reviewed: 2026-09-26

Records are kept as evidence of the above Partial

Owner: Operations manager
Evidence location: Fictional evidence / FW-EVID-001 / evidence index; review coverage incomplete
Last reviewed: 2026-09-26

Operational Rollout10 records

Record milestones as they happen. Start with an inventory and a practical boundary; policies and deeper reviews can follow as owners confirm them.

Publish Publish the governance charter with counsel review and a named owner.

Done: Not yet recorded
Date: Not yet recorded

Publish Publish the acceptable use policy and collect staff acknowledgments.

Done: Not yet recorded
Date: Not yet recorded

Publish Adopt the data governance standard and the human oversight procedure.

Done: Not yet recorded
Date: Not yet recorded

Inventory Start filling the inventory, one row per AI system or distinct use case.

Done: true
Date: 2026-09-26

Inventory Set a risk tier and a next review date on every inventory row.

Done: true
Date: 2026-09-26

Operate Put the approval form and the vendor assessment into your procurement path.

Done: Not yet recorded
Date: Not yet recorded

Operate Run an impact assessment for any high-impact use.

Done: Not yet recorded
Date: Not yet recorded

Operate Stand up the incident runbook roles and log incidents as they happen.

Done: Not yet recorded
Date: Not yet recorded

Review Run the ISO 42001 readiness checklist and log gaps in the risk register.

Done: true
Date: 2026-09-26

Review Brief leadership with the governance status report and set the reporting cadence.

Done: Not yet recorded
Date: Not yet recorded

Imported Source Records0 records

Full source records retained for review when there is no direct destination. These are references, not verified controls or approved questionnaire answers.

A report for internal reviewers.

Fernhill Wholesale

Recorded work and follow-up

AI Governance Toolkit

FICTIONAL SAMPLE
September 26, 2026
Prepared by: Operations lead

Management summary

This fictional example records working facts and open follow-up notes. Review the evidence and owner decisions before relying on any entry.

AI System and Use-Case Inventory: 6
Sections reviewed by preparer: 17/18
Section follow-up notes: 16
Evidence references: 33

Priority actions and decisions

Action	Next step	Owner	Due	Status
NOTE-1	Six AI uses documented, including one declined request. Ask the warehouse and sales teams about any other tools by October 15; no use sends anything to customers without a person checking it.	Confirm with section owner	Not yet recorded	Needs review
NOTE-2	Three decisions recorded: the weekly stock summary approved with conditions (fictional decision FW-DEC-001), product descriptions approved, and the personal voice-note app declined. Reassess before any customer or payment details are used.	Confirm with section owner	Not yet recorded	Needs review
NOTE-3	Six checks reviewed against fictional evidence FW-VEN-001. The contract review for customer data remains open; the office manager to resolve by October 15.	Confirm with section owner	Not yet recorded	Needs review
NOTE-4	Fictional assessment accepts the weekly stock summary with a person checking the totals, not automatic reordering. Confirm the checks at the October 15 review.	Confirm with section owner	Not yet recorded	Needs review
NOTE-5	Three active risks require follow-up; none is closed. The operations manager reviews the actions weekly.	Confirm with section owner	Not yet recorded	Needs review
NOTE-6	Purpose agreed for the first uses; the full charter is still a draft. Owners sign off before it goes to all staff.	Confirm with section owner	Not yet recorded	Needs review
NOTE-7	Policy adopted October 8, 2026, after the owners reviewed it. Staff acknowledgment is due October 15.	Confirm with section owner	Not yet recorded	Needs review
NOTE-8	Office and warehouse leads briefed. Staff acknowledgment and the briefing for temporary warehouse staff remain due on October 15.	Confirm with section owner	Not yet recorded	Needs review
NOTE-9	Deletion settings for the approved assistant need a checked test by October 15. No customer or payment details go into any tool before that review.	Confirm with section owner	Not yet recorded	Needs review
NOTE-10	Review and stop path agreed. Walk the operations and sales leads through stopping a tool and escalating by October 8.	Confirm with section owner	Not yet recorded	Needs review
NOTE-11	Run a short incident walk-through on October 8. Who tells customers and when needs the owners’ sign-off before wider use.	Confirm with section owner	Not yet recorded	Needs review
NOTE-12	One fictional correction made before a summary was shared. Add the check-the-totals lesson to the staff briefing; no actual customer incident is represented.	Confirm with section owner	Not yet recorded	Needs review
NOTE-13	Six assignments accepted. Confirm the training owner and cover for temporary warehouse staff by October 1.	Confirm with section owner	Not yet recorded	Needs review
NOTE-14	Complete the first working program by October 10, leaving five days for the owners’ review. Quarterly review due December 15.	Confirm with section owner	Not yet recorded	Needs review
NOTE-15	Milestones 4, 5 and 9 complete: six uses inventoried, risk tiers set and all 12 readiness items reviewed. 1–3 await staff acknowledgment of the adopted policy; 6 awaits purchasing integration; 7 has a limited impact review but no high-impact use is authorized; 8 awaits the walk-through; 10 is scheduled for October 10. Blank completion dates mean work is not complete.	Confirm with section owner	Not yet recorded	Needs review
NOTE-16	All 12 readiness items assessed: 2 in place and 10 partial. Priorities: collect staff acknowledgments of the adopted policy, finish asking teams about tools, confirm the supplier contract, run the walk-through and complete staff training. This is a fictional self-assessment, not certification.	Confirm with section owner	Not yet recorded	Needs review

Evidence position

0 of 33 indexed records are marked reviewed in this fictional example. Missing or unreviewed records remain explicit.

ID	Record	Owner	Date	Status
charter-0	AI Governance Policy and Charter	Operations director	2026-09-26	Needs review
charter-1	AI Governance Policy and Charter	Operations director	2026-09-26	Needs review
charter-2	AI Governance Policy and Charter	Operations director	2026-09-26	Needs review
charter-3	AI Governance Policy and Charter	Operations director	2026-09-26	Needs review
charter-4	AI Governance Policy and Charter	Operations director	2026-09-26	Needs review
charter-5	AI Governance Policy and Charter	Operations director	2026-09-26	Needs review
acceptable-use-0	AI Acceptable Use Policy	Operations manager	2026-09-26	Needs review
acceptable-use-1	AI Acceptable Use Policy	Operations manager	2026-09-26	Needs review
acceptable-use-2	AI Acceptable Use Policy	Operations manager	2026-09-26	Needs review
acceptable-use-3	AI Acceptable Use Policy	Operations manager	2026-09-26	Needs review
acceptable-use-4	AI Acceptable Use Policy	Operations manager	2026-09-26	Needs review
data-governance-0	Data Governance Standard for AI	Office manager	2026-09-26	Needs review
data-governance-1	Data Governance Standard for AI	Office manager	2026-09-26	Needs review
data-governance-2	Data Governance Standard for AI	Office manager	2026-09-26	Needs review
data-governance-3	Data Governance Standard for AI	Office manager	2026-09-26	Needs review
data-governance-4	Data Governance Standard for AI	Office manager	2026-09-26	Needs review
data-governance-5	Data Governance Standard for AI	Office manager	2026-09-26	Needs review
oversight-0	Human Oversight and Escalation Procedure	Operations manager	2026-09-26	Needs review
oversight-1	Human Oversight and Escalation Procedure	Operations manager	2026-09-26	Needs review
oversight-2	Human Oversight and Escalation Procedure	Operations manager	2026-09-26	Needs review
oversight-3	Human Oversight and Escalation Procedure	Operations manager	2026-09-26	Needs review
readiness-0	ISO 42001 Readiness Checklist	Operations director	2026-09-26	Needs review
readiness-1	ISO 42001 Readiness Checklist	Operations manager	2026-09-26	Needs review
readiness-2	ISO 42001 Readiness Checklist	Operations manager	2026-09-26	Needs review
readiness-3	ISO 42001 Readiness Checklist	Operations manager	2026-09-26	Needs review
readiness-4	ISO 42001 Readiness Checklist	Operations manager	2026-09-26	Needs review
readiness-5	ISO 42001 Readiness Checklist	Office manager	2026-09-26	Needs review
readiness-6	ISO 42001 Readiness Checklist	Operations manager	2026-09-26	Needs review
readiness-7	ISO 42001 Readiness Checklist	Office manager	2026-09-26	Needs review
readiness-8	ISO 42001 Readiness Checklist	Office manager	2026-09-26	Needs review
readiness-9	ISO 42001 Readiness Checklist	Warehouse supervisor	2026-09-26	Needs review
readiness-10	ISO 42001 Readiness Checklist	Operations director	2026-09-26	Needs review
readiness-11	ISO 42001 Readiness Checklist	Operations manager	2026-09-26	Needs review

Before sharing

Confirm the scope, replace every fictional record with your own, review the supporting evidence, and approve the final wording. Completed records can inform decisions; they do not establish certification or compliance.