AI governance checklist

What to have in place before models and agents run your work.

I'm reviewing how my organization governs its AI models and agents, using the checklist at https://ronnybadilla.com/checklist. If you have access to my repositories and documentation, check them against every item below and tell me which are covered, which are missing, and what evidence exists for each. If you don't, ask me for what you need first. Do not decide policy, risk appetite, owners, or tools for me. Flag those as decisions I have to make.

0 / 4

Know which models, datasets, providers, and environments you govern, and which you leave out.
Know which rules apply to you and where each one comes from.
Write down what governance will deliver and how you will know it worked.
Keep the big decisions yours. Policy, risk appetite, owners, tools. Advisors and agents flag them, they do not make them.

0 / 5

Every control has an owner, leaves evidence, and runs on a schedule. Every process names who does it and who approves it.
Controls live inside the daily work of the team that does it. Nothing waits for a review after the fact.
Builders own quality, shippers own the automated gates, product owns purpose and acceptance, governance owns policy and exceptions.
Use one template per artifact, so a model card looks the same for every model.
Choose the level of rigor yourself. More gates cost speed, fewer cost control.

0 / 6

Register every model at intake with its purpose, owner, data, and risk.
Have someone who did not build the model validate it for performance, bias, and compliance.
Do not deploy without monitoring and a way to roll back.
Set the thresholds for drift and incidents before release, not after the first one.
Treat every change as a small release. Assess, approve, record.
Retire models on purpose. Switch them off, keep the evidence, tell whoever depends on them.

0 / 5

Keep an inventory of every model. Owner, version, status, criticality, dependencies, where it runs.
Every model has a card. Purpose, data, method, limits, performance, known risks.
Every approval says who, what, when, under which conditions, and until when.
Evidence is tied to a model version and cannot be edited after the fact.
Decide who maintains the records, how often they are reviewed, and how long they are kept.

0 / 5

Check regularly that controls run and leave the evidence they promise.
Look for controls that are missing, failed, expired, or undocumented.
Rank each gap by impact and urgency. Report status, exceptions, and the risk that remains.
Every gap gets an owner and a date. It closes only when the fix is verified and the evidence kept.
Risk acceptance, priorities, and exceptions are signed by someone authorized to sign them.

0 / 5

Find where governance is slow, duplicated, error-prone, or manual.
Measure it. Time to approval, compliance rate, exceptions, manual effort.
Automate the controls that can be automated. Validation, approvals, evidence capture, alerts.
Improve from what happened. Audits, incidents, metrics, feedback.
Decide what stays under human eyes and how much you are willing to invest.

0 / 6

Test generative models against the real use case for hallucination, bias, leaks of private data or IP, harmful output, and adversarial prompts.
Limit what an agent can do. Its tools, permissions, memory, and actions outside the system.
Keep a human able to review, set limits, escalate, and stop the system.
Log the model, prompt, sources, version, and every action taken.
Watch for degradation, abuse, and silent changes in third-party models.
Decide which uses are authorized and how much autonomy you accept. Revisit as the technology and the rules move.

Occasional notes on design, infrastructure, and AI. No spam.