AI Governance.

Define AI ownership

No role owns the system after it is deployed.

Establish AI approval processes

Systems go live without a recorded approval.

Assign risk responsibilities

Risks are listed and nobody is assigned to them.

Create AI governance structures

Decisions about AI have no forum, cadence, or authority.

Identify AI risks

Risks are found after an incident, not before deployment.

Assess risk severity

Risks are named without a judgement of how serious they are.

Define mitigation controls

A known risk has no control that reduces it.

Monitor residual risk

Risk that remains after controls is not watched.

Translate regulation into controls

A legal duty never becomes a check the team can run.

Demonstrate compliance

The organisation cannot show which control meets which duty.

Manage AI inventories

The organisation does not know which systems it runs.

Implement regulatory reporting

Required notices and records are missing or late.

Define AI assurance methods

Claims about the system are not backed by a method someone else can repeat.

Require independent assessment

The only review is the team own review.

Establish certification

There is no external bar the system has to meet.

Define AI audit frameworks

Auditors have no agreed questions, evidence, or scope.

Detect AI incidents

Harmful failures are not defined as incidents, so they are not caught.

Report incidents

An incident stays inside the team that saw it.

Investigate incidents

The cause is never established, so the same failure repeats.

Coordinate incident response

Response is split across teams and nobody leads it.