From 452c061a7e4462375fd8e17c4e3a2e96e9db4e52 Mon Sep 17 00:00:00 2001 From: Magnus Hedemark Date: Fri, 14 Aug 2026 20:17:30 -0400 Subject: [PATCH] feat(ai-governance): add governance charter and use-case intake templates Add fillable governance-charter.md (council terms of reference) and use-case-intake-form.md (intake/registry entry with risk classification) templates, each with an H1 title, purpose statement, guided fields with placeholders, and completion instructions, aligned with the operating-model and risk/lifecycle references. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> --- ai-governance/templates/governance-charter.md | 108 ++++++++++++++++++ .../templates/use-case-intake-form.md | 91 +++++++++++++++ 2 files changed, 199 insertions(+) create mode 100644 ai-governance/templates/governance-charter.md create mode 100644 ai-governance/templates/use-case-intake-form.md diff --git a/ai-governance/templates/governance-charter.md b/ai-governance/templates/governance-charter.md new file mode 100644 index 0000000..a529ba2 --- /dev/null +++ b/ai-governance/templates/governance-charter.md @@ -0,0 +1,108 @@ +# AI Governance Council Charter + +> **Confidentiality:** A completed charter names accountable executives, decision rights, and escalation paths. Store it with access controls appropriate to governance and board-oversight information. This template instantiates the council terms of reference described in `references/governance-operating-model.md`. + +## When To Use + +Use this charter to stand up (or refresh) any AI governance body — an AI ethics council, an AI risk council, an enterprise AI committee, or a board-level technology committee. The operating model reference explains the tiered council structure; this template turns the council's purpose, membership, responsibilities, decision rights, cadence, and reporting lines into a written terms of reference. Complete it when the council is created and review it at least annually or whenever the operating model or risk profile changes. + +## When Not To Use + +Do not use this template as a substitute for an individual role's job description, and do not use it to assign operational work that belongs to stewards and functional owners. A charter governs how a body deliberates and decides; it is not a RACI for every task. Use `model-risk-assessment.md` for single-model reviews and `use-case-intake-form.md` for routing individual use cases. + +## Charter Meta + +| Field | Value | +|---|---| +| Council name | `` | +| Charter version | `` | +| Effective date | `` | +| Next review date | `` | +| Sponsor / accountable executive | `` | +| Status | `` | + +## Purpose + +State, in one to three sentences, why the council exists and what outcomes it is accountable for. Anchor it to a mission statement so every decision can be traced back to it. + +- Council purpose: `` +- What the council is accountable for: `` +- What the council must NOT decide alone: `` + +## Membership + +List the representative roles and named individuals. A cross-functional council should bring together legal, risk, compliance, privacy, security, data, product, and engineering. Note alternates so the body is never blocked by a single person's absence. + +| Role | Representative | Alternates | Term / rotation | +|---|---|---|---| +| | | | | +| | | | | +| | | | | +| | | | | +| | | | | +| | | | | +| | | | | + +- Quorum: `` +- Decision method: `` + +## Responsibilities + +List the standing duties of the council. Tie each duty to the stage of the AI life cycle or the risk framework where it bites. + +- Set and maintain AI policy, standards, and principles: +- Review and approve higher-risk AI use cases and their residual risk: +- Own the risk register and ensure entries above threshold are escalated: +- Review monitoring, incident, and drift signals and direct responses: +- Oversee third-party and procured AI diligence: +- Prepare aggregate risk reporting for the executive team and board: + +## Decision Rights And Escalation + +Make explicit who the council can decide, who it must consult, who it must inform, and how disputes are raised. Reference the operating model's RACI so one person is accountable for each outcome. + +| Matter | Decision right | Consulted | Informed | Escalation path | +|---|---|---|---|---| +| Approve low-risk use case | | | | | +| Approve medium-risk use case | | | | | +| Approve high-risk use case | | | | | +| Approve residual-risk exception | | | | | +| Declare material incident | | | | | + +- Escalation trigger and path: +- Dispute resolution: + +## Meeting Cadence And Operation + +Define how often the council meets, what it reviews, and how members prepare. The operating model reference notes that councils need a regular cadence and ground rules for psychological safety so that honest discussion, including disagreement, is possible. + +- Meeting frequency: +- Session length: +- Standing agenda items: +- Pre-read expectations: +- Ground rules for discussion: +- Record keeping: + +## Reporting And Oversight + +Describe how the council reports up (to the executive sponsor and board) and down (to stewards and operating owners), consistent with the board tier's "noses in, fingers out" oversight posture. + +- Reports to: +- Report cadence and contents: +- Material-incident briefing path: +- Interactions with stewards and operating owners: + +## Effectiveness Review + +Define how the council evaluates its own performance so the charter stays a living instrument, not a filed artifact. + +- Review trigger: +- Effectiveness criteria: +- Success measures: +- Amendment process: + +## Completion + +To complete and ratify this charter: fill every labeled field, confirm each named member and alternate, obtain sign-off from the accountable executive (and board sponsor where applicable), record the ratification date and version, and store the ratified copy in the shared governance location referenced by the operating model. Schedule the next review date before circulating the final version. + +> **Synthesized from** `research-org-board-governance.md` and the ideas of *Designing Data Governance from the Ground Up* and the *Data Governance Handbook* (see `references/governance-operating-model.md`). Fillable artifact of the `ai-governance` skill. diff --git a/ai-governance/templates/use-case-intake-form.md b/ai-governance/templates/use-case-intake-form.md new file mode 100644 index 0000000..00973ed --- /dev/null +++ b/ai-governance/templates/use-case-intake-form.md @@ -0,0 +1,91 @@ +# AI Use-Case Intake Form + +> **Confidentiality:** A completed intake form describes data, decisions, and risk. Store it with access controls appropriate to the sensitivity of the use case. This template turns the earliest lifecycle gate and the risk-register entry described in `references/risk-management-and-frameworks.md` and `references/ai-lifecycle-governance.md` into a fillable form. + +## When To Use + +Use this form to open a governed lifecycle for any proposed or newly discovered AI use case — whether built in-house, procured from a vendor, or embedded in an inherited system. Completing it routes the use case into the risk register and to the correct depth of review before significant investment, model training, or deployment. Submit it at the intake stage; revisit it when the use case, data, or context changes materially. + +## When Not To Use + +Do not use this form as a substitute for a full single-model risk assessment. If the use case already exists and you are evaluating an individual model's residual risk, use `model-risk-assessment.md`. This form captures intent and initial classification; it does not replace monitoring, drift detection, or incident response after deployment. + +## Use-Case Identity + +| Field | Entry | +|---|---| +| Use-case name | | +| Use-case ID | | +| Submitted by | | +| Submitted date | | +| Business unit / domain | | +| Status | | + +## Purpose And Context + +Describe what the use case does, who it serves, and why it is being built or adopted. + +- Problem statement: +- Intended function: +- Users and affected parties: +- Expected benefit: +- Alternatives considered: + +## Data And Inputs + +Describe the data that trains and feeds the system. Sensitive, high-volume, or personal data raises the inherent risk and the controls required. + +- Primary data sources: +- Data sensitivity: +- Contains personal or special-category data: +- Data lineage and provenance: +- Data quality and known limitations: +- Retention and minimization: + +## Autonomy And Decision Impact + +Classify how much the system decides and how consequential its output is. This drives the tier. + +- Level of autonomy: +- Decision type: +- Decision impact: +- Scale of exposure: +- Opportunity for human override: + +## Initial Risk Classification + +Record the inherent risk (with no controls applied) and any immediate risk considerations, aligned with the tiering discipline in `references/risk-management-and-frameworks.md`. + +- Inherent risk tier: +- Primary risk drivers: +- Known biases or fairness concerns: +- Known security or integrity concerns: +- Suggested review depth: +- Proposed controls to reach acceptable residual risk: + +## Review Routing + +Route the use case to the right level of review based on its tier, and record the decision. + +| Routing field | Entry | +|---|---| +| Assigned reviewer / assessor | | +| Review path | | +| Required approvals | | +| Escalation trigger | | +| Linked risk-register entry | | + +## Decisions And Next Steps + +Record the outcome and the follow-up actions so the intake is closed out. + +- Decision: +- Conditions or mitigations required: +- Next steps and owners: +- Re-review trigger: + +## Completion + +To complete this intake: fill every labeled field, confirm the submitted-by and business owner, perform the initial risk classification honestly (inherent risk first), route the form to the assigned reviewer through the path your operating model defines, record the decision and any conditions, and file the completed entry in the risk register as the source-of-record. Revisit the form whenever the use case, data, context, or risk tier changes materially. + +> **Synthesized from** `research-standards.md` and `research-technical-controls.md` and the ideas of *Responsible AI in the Enterprise* and *Platform and Model Design for Responsible AI* (see `references/risk-management-and-frameworks.md` and `references/ai-lifecycle-governance.md`). Fillable artifact of the `ai-governance` skill.