AI system governance policy
Organisation: [complete] · Owner: [complete] · Approved by: [complete]
Effective from: [complete after approval] · Review: [complete]
Inventory and permitted use
For each system, record its owner, purpose, users, supplier, data, integrations and lifecycle status. Define approved tools and uses; approving one service does not approve every purpose or data category.
Legal classification
Distinguish a model from an AI system. Identify the company’s roles, review Article 5 prohibitions, high risk under Article 6 and both Annexes I and III, and separately Article 50 transparency. Using another provider’s model API does not automatically make the company only a deployer. Classification guide.
A high-risk system provider and its deployer have different obligations. Record the applicability date of each relevant requirement in the inventory.
Approval before use
| Area | Evidence for approval |
|---|---|
| Purpose and quality | Test scenarios, results, limitations and acceptable errors |
| Data | Permitted inputs, legal basis, contract terms and retention |
| Security | Permissions, integrations, records and a tested failure response |
| Human oversight | Who reviews which outputs, how they intervene and what they need to know |
| Operation | Owner, monitoring, change and incident procedures |
Processing by a supplier acting as a processor must be governed by a contract (DPA) or another legal act under GDPR Article 28; also check that the supplier provides sufficient guarantees. Carry out a DPIA when Article 35 conditions apply; neither using AI nor an enterprise label determines the answer alone.
Staff instructions
Use approved purposes and data categories, verify significant outputs, do not grant AI tools permissions without approval, and report errors to the designated contact. Content labelling must match the specific obligations and internal rules; the same duty does not apply to every private draft.
Changes and evidence
Assess changes to purpose, model, data, integrations or supplier before deployment. Keep proportionate evidence and open findings. A model card is useful documentation, but does not replace all technical documentation required for a particular system.
Set retention by record type and role. Follow the incident procedure and prepare training around roles and actual use.
Template reviewed on 6 September 2026. Detailed legal sources are in the linked guides. L1 — Align helps prepare evidence and responsibilities; adaptation and implementation scope is agreed in the proposal.