An operational worksheet for translating AI principles into enforceable governance, structured around the Five-Layer Governance Stack and the three risk tiers from Minimum Viable Governance.
Canonical reference: Show Me the Last Time Your AI Principles Changed a Decision
One model, three stages: Assess, days 0 to 90 (the MVG worksheet) → Align, months 3 to 6 → Assure, ongoing. This worksheet covers Align and Assure.
Principles do not govern. Processes do. A signed AI ethics statement is not governance. Governance is who decides, on what evidence, with what consequences for getting it wrong. The five-layer stack (Policy, Process, Tooling, People, Assurance) is the structure that converts principles into operational discipline.
Every layer needs a named owner. Not a committee. Not a department. A named individual with the authority to decide and the accountability to be wrong. Governance without an owner is theatre. The accountability matrix on this worksheet is the discipline that prevents theatre.
For each principle, write a corresponding testable policy statement.
| AI Principle | Testable Policy Statement | Metric / Threshold | Applies to Tier |
|---|---|---|---|
| Fairness | |||
| Transparency | |||
| Accountability | |||
| Safety | |||
| Privacy | |||
For each policy statement above, confirm it passes this test:
Map each governance gate to its trigger, reviewer, and SLA.
| Gate Name | Trigger / When | Reviewer / Approver | SLA (hours/days) | Exception Process |
|---|---|---|---|---|
| Design Review | ||||
| Data Review | ||||
| Fairness Review | ||||
| Pre-Production | ||||
| Deployment Gate | ||||
| Post-Launch Review | ||||
| System Tier | Escalation To | Response Time | Decision Authority |
|---|---|---|---|
| Low tier | |||
| Medium tier | |||
| High tier | |||
| High tier, most critical systems |
| AI System | Owner | Decisions Influenced | Risk Tier | EU AI Act Classification | Governance Status |
|---|---|---|---|---|---|
For each system, evaluate these factors to assign a tier:
| Governance Function | Current State | Target Tool / Platform | Priority | Timeline |
|---|---|---|---|---|
| Bias / Fairness Testing | ||||
| Model Card Generation | ||||
| Drift Monitoring | ||||
| Explainability Reporting | ||||
| Data Lineage Tracking | ||||
| CI/CD Gate Enforcement | ||||
| Incident Alerting | ||||
| Audit Trail / Logging |
| Governance Activity | Responsible (Does) | Accountable (Owns) | Consulted | Informed |
|---|---|---|---|---|
| Policy Creation | ||||
| Risk Tier Classification | ||||
| Fairness Review | ||||
| Deployment Approval | ||||
| Incident Response | ||||
| Regulatory Compliance | ||||
| External Audit | ||||
| Governance Framework Review |
| Role | Named Individual | Decision Authority | Escalation To |
|---|---|---|---|
| Chief AI Officer / AI Lead | |||
| AI Governance Owner | |||
| AI Ethics Lead | |||
| Legal / Compliance Lead | |||
| Executive Sponsor | |||
| Category | KPI | Current Value | Target | Review Cadence | Owner |
|---|---|---|---|---|---|
| Prevention | Deployments caught pre-production | ||||
| Prevention | Estimated cost avoidance ($) | ||||
| Efficiency | Avg. time to governed deployment | ||||
| Efficiency | % reviews within SLA | ||||
| Compliance | % AI systems with documentation | ||||
| Compliance | Shadow AI exposure count | ||||
| Trust | Stakeholder confidence score | ||||
| Trust | Governance maturity score |
| Review Type | Frequency | Scope | Reviewer | Next Scheduled |
|---|---|---|---|---|
| Governance Framework Review | Quarterly | |||
| Model Performance Review | Monthly | |||
| Regulatory Alignment Check | Quarterly | |||
| External Audit | Annual | |||
| Executive Governance Report | Quarterly | |||
Honestly assess whether each anti-pattern exists in your organization. Check the box if you recognize the symptom.
Count of anti-patterns present: _____ / 5
0 = Mature governance. 1–2 = Address during next review cycle. 3+ = Governance requires immediate structural intervention.
Rate your organization's current state for each governance layer.
MVG's documents answer 12 of the 72 subcategories in NIST AI 100-1 (AI RMF 1.0). Align and Assure map the other 60. Each subcategory is listed once, under the layer that does most of the work; many touch more than one.
| Layer | Starts with, from MVG | Added in Align and Assure |
|---|---|---|
| Policy | AI system inventory (GOVERN 1.6); governance charter (GOVERN 1.4) | GOVERN 1.1, 1.2, 1.3, 6.1; MAP 1.3, 1.5, 1.6, 3.3 |
| Process | Context and impact record (MAP 1.1); risk register (MAP 5.1, MANAGE 1.2); deployment gate (MANAGE 1.1); escalation and incident procedure (MANAGE 4.1, 4.3) | GOVERN 1.7, 4.2, 6.2; MAP 1.4, 2.1, 3.1, 3.2, 4.1, 4.2; MEASURE 2.2, 3.3; MANAGE 1.3, 1.4, 2.1, 2.3, 3.1 |
| Tooling | Baselines and thresholds (MEASURE 1.1); production monitoring (MEASURE 2.4) | GOVERN 4.3; MAP 2.2, 2.3; MEASURE 2.1, 2.3, 2.5, 2.6, 2.7, 2.9, 2.10, 2.11, 2.12, 3.1; MANAGE 2.2, 3.2 |
| People | Accountability matrix (GOVERN 2.1); authority to pause (MANAGE 2.4) | GOVERN 2.2, 2.3, 3.1, 3.2, 4.1; MAP 1.2, 3.4, 3.5 |
| Assurance | The next review date, set at the deployment gate (no MVG subcategory) | GOVERN 1.5, 5.1, 5.2; MAP 5.2; MEASURE 1.2, 1.3, 2.8, 2.13, 3.2, 4.1, 4.2, 4.3; MANAGE 4.2 |
Source: NIST AI 100-1, January 2023, Tables 1 to 4. The canonical article gives a short description of each group.
Use this planner to assign owners and deadlines for the Align stage. Recommended timeline: 13 weeks, weeks 14 to 26 (months 3 to 6), picking up where the MVG worksheet's 13-week planner ends.
Definitions used throughout this worksheet. These align with the canonical methodology article.
Five-Layer Governance Stack. Policy → Process → Tooling → People → Assurance. The five operational layers that together convert AI principles into enforceable governance. Skipping any layer creates a gap that compounds.
Risk Tier. High, Medium and Low, the same three tiers as Minimum Viable Governance. High affects a person's rights, safety, money or job; Medium shapes business decisions or customer experience; Low is an internal tool with no consequential output. Higher tiers get more senior approval and more frequent review. Internal tiers, separate from legal classifications such as the EU AI Act's.
Assess, Align, Assure. One model in three stages. Assess (days 0 to 90) is Minimum Viable Governance. Align (months 3 to 6) builds each MVG document out into its layer. Assure (ongoing) runs the Assurance layer: reviews on each tier's cadence, with findings fed back into Policy.
Falsifiable Policy. A policy that specifies measurable, auditable conditions for compliance. “Be fair” is not falsifiable. “True and false positive rates within five percentage points across legally protected groups, tested before release and monitored monthly” is.
Anti-Pattern. A common governance failure mode that looks like governance but does not function as governance. The five named anti-patterns: Paper Tiger, Bottleneck Board, One-Size-Fits-All, Measurement Mismatch, Set-and-Forget.
RACI (Responsible / Accountable / Consulted / Informed). The accountability matrix for governance decisions. Each AI lifecycle event must have exactly one Accountable party. Multiple Accountables is the same as zero Accountables.
Governance Gate. A mandatory checkpoint in the AI lifecycle (deployment approval, model retirement, incident response) where governance criteria must be met before proceeding. Skipping a gate accumulates governance debt.
SLA (Service Level Agreement) for Governance. A defined response time for governance decisions, for example deployment approval within 5 business days, incident response within 1 hour for P1. Without SLAs, governance becomes the bottleneck the business routes around.
EU AI Act Penalty Tiers (Article 99). Up to €35M or 7% of worldwide annual turnover for prohibited practices (Art. 99(3)); up to €15M or 3% for breaches of operator obligations, including providers' high-risk duties, deployers' duties under Article 26 and the Article 50 transparency duties (Art. 99(4)); up to €7.5M or 1% for supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request (Art. 99(5)). For companies, whichever is higher; for SMEs, whichever is lower (Art. 99(6)); for small mid-caps, whichever is lower for the 99(4) and 99(5) fines (Art. 99(6a), added by Regulation (EU) 2026/1744). Calibrate the assurance layer to these exposures.
This worksheet is the operational layer of a published, sourced framework. The methodology, anti-pattern analysis, and external citations live in the canonical article below.
Canonical article: Show Me the Last Time Your AI Principles Changed a Decision: the five-layer stack, the three risk tiers shared with MVG, the NIST layer map and the five failure patterns, with sources.
Companion frameworks:
Key external sources: EU AI Act, consolidated text (AI Act Service Desk) · Regulation (EU) 2026/1744 · NIST AI 100-1 (AI RMF 1.0) · Fairlearn · AI Fairness 360