AI Governance in Practice
Keep a one-page record of the AI tools you use
5 min read · Updated 2026-11-08
One page, the same headings every time
When a tool is approved, write a page with the same headings: what we use it for, what we do not use it for, which account we use, what data is allowed in, who owns the relationship, and when we will look again. Link the vendor's answers to your questions if you have them. Date the page.
The point of the same headings is that a new colleague can compare two tools without learning two formats. A folder of emails cannot do that.
The owner is a person
"IT owns it" is not an owner. Name someone who can turn the tool off, ask the vendor a question, and notice if a team starts using it for a new job. That person does not have to be technical. They have to be reachable.
If a team wants a new use, the owner updates the page before the use starts. A tool approved for drafting internal notes is not automatically approved for answering customers.
Look again on a date you already chose
Put a review date on the page, six or twelve months out, or sooner if the vendor changes the model or the terms. The review can be short: are we still using it for the stated job, did anything go wrong, do the terms still match what we were told? A page with no date becomes folklore.
This is general education, not legal advice. The page is a business record. It is not, by itself, evidence that a legal duty has been met.
This article is general education, not legal advice. ComplianceEU Alliance is an independent private initiative, not a regulator or certification body.