2027 AI Governance Checklist

Know your AI

List every AI tool and AI feature in use, including features vendors added to existing software
Name an owner for each AI use
Assign each use a risk tier

Set the rules

Adopt or update an AI acceptable use policy
Define which data may never be entered into AI tools
Set an approval process for new AI uses

Check your obligations

Confirm which state AI laws apply, including Colorado and California rules taking effect January 1, 2027
Review privacy notices for AI-related data sharing
Check industry rules such as HIPAA, fair lending, or FERPA

Control your vendors

Confirm vendors don’t train on your data
Add AI terms to contracts at renewal
Require notice before model changes

Test and prepare

Test high-risk AI systems before launch and after major changes
Add AI scenarios to your incident response plan
Run a tabletop exercise with leadership

Train and report

Train staff on your AI policy
Brief the board or leadership on AI risks
Schedule a review of this checklist each quarter

Need help working through the list? Our AI Governance Readiness Assessment covers every item.

This page is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.

Checklist