Checklist

An agent scorecard turns a vague sense that it is working into numbers. This template covers completion, quality, escalation, cost, and safety measures.

A capacity model turns guesses into numbers you can defend. This template covers the inputs, the arithmetic, and the assumptions that need stating.

A data map answers where data came from, where it went, and who saw it. This template covers what to record so the map answers real questions.

Evaluation results that nobody trusts change nothing. This template covers reporting scope, method, results, and limitations so the report supports a decision.

When behaviour changes unexpectedly, the change log is what makes investigation possible. This template covers what to record per entry.

A risk assessment is useful when it names concrete failures and who they harm. This template covers scenarios, mitigations, and the acceptance that closes it.

AI systems depend on tool servers, prompts, and models that change without a release on your side. This checklist covers inventorying and reviewing them.

Escalation matrices fail when severity is vague and nobody has authority. This template covers the definitions, routing, and authority that make one work.

AI latency is dominated by decisions rather than by code. This checklist covers time to first token, prompt size, caching, parallelism, and perceived speed.

The first governance question is what AI systems you run. This template covers what to record per entry so the catalog answers the questions that follow.

Support teams inherit AI systems they did not build and cannot diagnose. This checklist covers what they need before the first ticket arrives.

Training on AI tools usually covers features and skips limits. This checklist covers what users actually need to work with a system that is sometimes wrong.

Bias testing works when it measures outcomes across groups rather than checking intentions. This checklist covers defining, measuring, and monitoring disparity.

Consent for AI processing has to be specific, recorded, and withdrawable — and withdrawal must actually reach every system. This checklist covers the mechanics.

AI systems copy data into more places than teams realise — indexes, caches, logs, warehouses. This checklist covers retention and deletion that actually reaches all of them.

A model's self-explanation is another generation, not an account of its computation. This checklist covers explaining decisions in ways that are actually true.

AI penetration tests find different things from application tests. This checklist covers scope, the attack classes worth testing, and the boundaries to agree first.

AI provider keys are high-value and frequently over-shared. This checklist covers inventory, rotation without downtime, scoping, and detecting a leaked key.

AI adds subprocessors most organisations have not mapped — model providers, inference hosts, and their own dependencies. This checklist covers the chain.

AI interfaces introduce accessibility problems conventional pages do not: streaming text, uncertain output, and chat as the only input method.

Generated content is fluent, which is exactly why it needs checking. This checklist covers facts, claims, voice, attribution, and the exposure that fluency hides.

Handing over an AI system fails when the documents transfer and the knowledge does not. This checklist covers what to transfer and how to verify it landed.

The corpus sets the ceiling on answer quality. This checklist covers auditing coverage, freshness, contradictions, and ownership before blaming the model.

AI systems that work in English frequently degrade elsewhere without anyone noticing. This checklist covers retrieval, evaluation, and review per language.