An editable Word checklist for deploying AI without creating a security or compliance problem. Five domains, critical and supporting controls, owner and evidence columns, and a sign-off block you can put in front of an auditor.
Only the right people reach the tool, through your identity system, with access you can remove in one place.
Know exactly what data enters the tool, where it goes, how long it stays, and whether it can train a model.
A short, deliberate list people actually know about - and a working path for adding to it.
Company work happens in the company tenant. This is the single most common failure point in real deployments.
The deployment holds up under an audit, a customer security questionnaire, or a contract review.
Business owner, security reviewer, compliance reviewer, decision, accepted risks, and the next review date - the documentation that proves the decision was deliberate.
Download template (.docx)Run the checklist before a pilot to catch anything that would block production later.
Answer every Critical row before the tool touches real company data.
Assign an owner and record evidence in the columns provided - that record is what auditors ask for.
Re-run it annually, and any time the vendor changes terms, models, or subprocessors.
Bracketed fields are yours to replace. This is a starting point, not legal advice - have counsel and your compliance owner review anything that flows into a customer contract or regulated environment.
This checklist verifies your implementation. The AI Governance Policy Starter Kit gives you the policy, approval process, employee guidelines, and vendor review checklist those controls reference - and the readiness assessment tells you where to start.
Disclaimer
Nothing on this page or in any accompanying template, assessment, checklist, or report constitutes legal, financial, or compliance advice. These materials are general-purpose starting points drawn from professional experience. Review all information thoroughly against your own internal needs, company structure, contractual obligations, and regulatory environment, and have your legal counsel review anything you adopt before you rely on it.