Governance and accountability

Template to adapt

This is a public template, not your organisation’s effective internal policy. Before use, complete the organisation, owner, approver, scope, effective date and review date. Adapt controls to actual risks and obligations.

Organisation: [complete] · Owner: [complete] · Approved by: [complete]

Effective from: [complete after approval] · Review: [complete]

Purpose and scope

Specify the organisational units, systems and activities covered. Record applicable rules and the reason they apply. The aim is clear decisions and evidence of action; the policy itself does not guarantee compliance.

Roles

Role	Task	Decision rights to define
Leadership	Approve objectives, capacity and tolerance for permissible risks	Who approves the policy and significant exceptions
AI system owner	Maintain purpose, inventory, evidence and corrective actions	Who approves operation and changes
IT / security	Design and operate technical controls	Who may restrict or stop a service
Legal and compliance support	Assess legal questions and changes	Who advises and who decides
DPO, where appointed	Independently advise and monitor personal data protection	Direct access to highest management; no conflict of interest

The controller’s GDPR accountability does not transfer to the DPO. Credentials such as CIPP/E or CISSP may help assess competence; they are not universal statutory prerequisites for these roles.

Decisions and escalation

For a new system, change of purpose, supplier or incident, name the person doing the work, the accountable decision maker and the consulted roles. Separate decision steps where two approvals are needed. Serious risks must not wait for a routine meeting.

Record the evidence, date, approver, conditions and review point. Risk acceptance cannot authorise a legally prohibited activity.

Review and records

Set reviews around portfolio changes and risks. Internal review, external audit and certification serve different purposes; an annual certification audit is not a universal requirement for every company.

Create a retention schedule for documents, logs, training and incidents based on purpose, role and applicable law. Do not apply one five-year period to everything. Retention and logging guidance.

Before approval

Complete names and deputies, verify decision rights, available contacts, record keeping and staff awareness. Obtain regulatory contact details from the relevant authority’s current official procedure for the specific notification.

---

Template reviewed on 6 September 2026. Detailed legal sources are in the linked guides. L1 — Align helps prepare evidence and responsibilities; adaptation and implementation scope is agreed in the proposal.