▸ Cornerstone Document · v1.0 · Confidential
AI Governance Cornerstone — [Client Name]
A governance foundation for the safe, defensible, and scalable deployment of AI across [Client]'s operations — board-ready, audit-aligned, and operating-reality-fit.
Page 2 · Table of Contents
Contents
- 01Executive Summaryp. 3
- 02AI Governance Frameworkp. 7
- 03Risk Register & Impact Matrixp. 15
- 04Decision Rights Mapp. 23
- 05Use-Case Intake Processp. 29
- 06Vendor & Tooling Policyp. 33
- 07Audit & Measurement Cadencep. 38
- 08Prioritized Next-Initiative Viewp. 42
- 09Appendices & Source Materialp. 45
Pages 3–6 · Executive Summary
01 · Executive Summary
[Client] currently operates 14 AI-touching tools across 6 business units, with 3 carrying high regulatory exposure (EU AI Act Article 5 + 10) and 2 requiring immediate vendor-policy remediation. The governance framework outlined in this document brings all 14 under a single decision-rights structure with a documented intake process and a quarterly audit cadence — closing the gap between current state and what a defensible board posture requires.
Of the 5 AI initiatives [Client] is planning in the next 12 months, 3 are cleared to proceed under the framework, 1 requires additional risk-register entries before scope is approved, and 1 is recommended for restructure to reduce data-flow exposure. The board-readiness assessment in Section 7 confirms the framework satisfies the AI clauses in the [Insurer] D&O renewal due [Date].
Where [Client] stands today
- AI inventory: 14 tools active across Marketing (4), Engineering (3), Sales (2), Customer Support (2), Legal (1), Finance (1), HR (1). Eight were procured through formal IT/Procurement; six were not.
- Regulatory exposure: 3 tools touch EU resident data (Article 5 + Article 10 obligations). 1 tool processes CCPA-covered California consumer data. 0 tools currently subject to sector-specific AI rules (federal or state).
- Governance maturity: No published AI policy. No documented intake process. No risk register. No decision-rights structure. No audit cadence. This is the typical starting state pre-Cornerstone.
- Insurance posture: D&O renewal due [Date] includes an AI-attestation question block that the current state cannot answer. Carrier indicates the attestation form will be acceptable evidence.
Recommendation summary
Adopt the governance framework in Section 02 as [Client]'s standing AI policy, effective [Date]. Operationalize the intake process in Section 05 as the gate for any new AI initiative, owned by the [VP Engineering + General Counsel] joint approver pair. Schedule the first quarterly audit per Section 07 for [Date], with the board summary memo (this document, Section 01) refreshed annually.
Pages 4–6 of the Executive Summary cover: detailed inventory by business unit · risk-tier breakdown · regulatory mapping by jurisdiction · the recommended 12-month adoption sequence · board-resolution language drafted for the next audit committee meeting.
Pages 7–14 · Governance Framework
02 · AI Governance Framework
The framework defines what AI [Client] will use, what it won't, who decides, and how the organization keeps that defensible. It is the operating policy — every Cornerstone artifact downstream is an instantiation of the principles below.
Five principles
- Governance precedes deployment. No AI initiative reaches production without passing the intake process in Section 05. Existing deployments are subject to retroactive review per the schedule in Section 07.
- Risk before opportunity. Every AI initiative carries a documented risk-register entry before approval. Initiatives that cannot be scored are not approved.
- Human ownership for decisions of consequence. AI systems that produce decisions affecting customers, employees, or legal posture require a named human approver per the Decision Rights Map in Section 04.
- Evidence before attestation. Anything [Client] commits to externally — to a regulator, to an insurer, to a partner, to the board — is grounded in artifacts maintained per Section 07.
- Vendors are accountable. No third-party AI vendor is approved without the data-handling, security, and contract terms in Section 06. Inventory is maintained continuously.
Scope
In scope: any deployed software, vendor service, or internal tool that produces outputs derived from machine-learning inference, large-language-model generation, or statistical decision systems — including embedded AI features in third-party SaaS where [Client] is the data controller.
Out of scope: non-AI automation (rules engines, RPA without ML, deterministic workflows), AI features used solely for personal productivity where no [Client] data is transmitted to the model, and read-only AI features in vendor tools where [Client] data is not used for training and does not leave [Client] systems.
Pages 8–14 of the Framework cover: definitions glossary · jurisdictional mapping · sector-specific overlays where applicable · framework-to-control mapping (EU AI Act, NIST RMF, ISO/IEC 42001) · exception process and exception register · annual review trigger.
Pages 15–22 · Risk Register
03 · Risk Register & Impact Matrix
23 active risks scored on likelihood × impact, owned by named accountable executives, with mitigation paths and review cadence. Sample entries below.
| ID | Risk | Likelihood | Impact | Owner | Review |
|---|
| R-014 |
Customer-facing LLM summarization tool processes EU resident PII without DPIA documentation. EU AI Act Article 5 + 10 exposure. |
HIGH |
HIGH
up to 7% global revenue |
VP Eng + General Counsel |
Monthly |
| R-018 |
Sales-enablement chatbot trained on call transcripts; customer consent ambiguous in 2024–2025 calls. |
MED |
HIGH |
CRO + General Counsel |
Quarterly |
| R-021 |
Engineering Copilot deployed on a per-seat basis with no documented data-flow policy. Source-code exposure assessment pending. |
HIGH |
MED |
VP Engineering |
Monthly |
| R-007 |
Marketing copy generator uses [Client] brand voice without documented training-data rights review. |
MED |
MED |
CMO + General Counsel |
Quarterly |
| R-002 |
HR resume-screening AI not validated for adverse-impact bias per EEOC guidance. Discontinued during engagement (see Section 8). |
CLOSED |
CLOSED |
CHRO |
— |
Full Risk Register continues on pages 16–22 with all 23 entries, plus the methodology section: scoring rubric, threshold definitions, mitigation taxonomy, escalation triggers, and the standard quarterly review template.
Pages 23–28 · Decision Rights Map
04 · Decision Rights Map
Who approves what at which threshold. Clear escalation paths from individual use to enterprise-wide rollout. Sample matrix below; full document has 11 use classes and 6 escalation thresholds.
| AI use class | Approver | Threshold | Escalation |
|---|
| Internal productivity (Copilot-class) |
Department head |
Approved-vendor list only |
VP Engineering on policy exception |
| Customer-facing inference |
VP Eng + Legal (joint) |
DPIA required; risk-register entry mandatory |
CRO + CEO on production rollout |
| High-risk decision automation |
Executive Committee |
Board notification for production |
Board approval for >$500K annual value |
| EU / regulated jurisdiction data |
Executive Committee + GC |
DPIA + Article 9/10 review + board minute |
Board approval mandatory |
| Vendor-embedded AI features |
VP IT + Procurement |
Vendor security review + contract addendum |
General Counsel on data-residency exceptions |
Pages 24–28 of the Decision Rights map cover: full 11-class matrix · 6 escalation thresholds with specific dollar/scope triggers · org-chart overlay showing every named approver · interim/acting-approver coverage for vacation and turnover · the exception process and exception log template.
Pages 29–32 · Use-Case Intake Process
05 · Use-Case Intake Process
The gate every new AI initiative passes through. Repeatable workflow with documented criteria, not back-room conversations.
Step 01
Intake form
Sponsor submits via portal; auto-classified by use class
Step 02
Risk screen
Pattern-match against risk register; assign tier
Step 03
Approver review
Per Decision Rights Map; SLA: 5 business days
Step 04
Conditions
DPIA / vendor review / contract addendum if triggered
Step 05
Go / no-go
Decision logged; sponsor notified; quarterly review scheduled
Standard SLAs: Internal productivity tools approved or denied within 5 business days. Customer-facing inference reviews take 10–15 business days (DPIA-dependent). High-risk decision automation goes to the next regular Executive Committee meeting; emergency review available with CEO approval.
Pages 30–32 of the Intake Process cover: the intake form template (12 fields) · the decision-logging template · the conditions-tracking template · the quarterly review template · the appeals process for denied initiatives.
Pages 33–37 · Vendor & Tooling Policy
06 · Vendor & Tooling Policy
Approved providers, data-handling requirements, contract language, and the inventory of what's currently in flight inside [Client]'s walls.
Approved vendors (excerpt of 14 entries)
| Vendor | Use class | Data residency | DPA on file | Status |
|---|
| [Vendor A] | LLM API · enterprise tier | US-only available | v2.1 · expires [Date] | APPROVED |
| [Vendor B] | Code completion · individual seats | US/EU options | v3.0 · enterprise | APPROVED |
| [Vendor C] | Customer-data summarization | EU-only, GDPR aligned | v1.4 · pending | CONDITIONAL |
| [Vendor D] | Marketing copy generation | US-only | — | PENDING REVIEW |
| [Vendor E] | HR resume screening | US-only | — | SUNSET |
Pages 34–37 of the Vendor Policy cover: the full 14-vendor inventory · data-handling requirements per use class · standard contract addendum language · DPA review checklist · sunset / exit procedures · the procurement-to-AI-governance workflow integration.
Pages 38–41 · Audit & Measurement Cadence
07 · Audit & Measurement Cadence
What [Client] measures quarterly, what gets re-certified annually, and what evidence is kept when the auditor or board asks.
Q1
- Inventory refresh — full AI-tool census
- Risk register review — score recalibration
- Vendor DPA expiry check
Q2
- Framework annual review — principles + scope
- Decision Rights update — org-chart sync
- Intake SLA report
Q3
- D&O / insurance prep — attestation refresh
- Vendor inventory audit
- Board readout — executive summary
Q4
- Regulatory landscape update — EU AI Act, NIST, state laws
- Next-year roadmap refresh
- Exception register cleanup
Pages 39–41 of the Audit Cadence cover: monthly operational metrics (intake volume, SLA adherence, escalation rate) · annual artifacts (board attestation, insurer attestation, regulator-ready summary) · evidence retention policy (7-year default; sector overlays) · audit-trail template.
Pages 42–44 · Prioritized Next-Initiative View
08 · Prioritized Next-Initiative View
What [Client]'s 12-month AI initiative pipeline looks like under the new framework — what's cleared, what's conditional, what's restructured.
APPROVED
Internal Copilot rollout — Engineering + Product
Approved-vendor list; per-seat license model. Quarterly source-code-exposure check via Section 07 cadence. Estimated value: $1.8M annual productivity gain.
Q3 2026
APPROVED
Marketing copy assistant — migrate to approved vendor
Replace current [Vendor D] with approved [Vendor A]; brand-voice training-data rights documented. De-risks R-007.
Q3 2026
APPROVED
Sales-enablement summarization — internal data only
Restricted to internal-only data sources; customer-call transcripts out of scope until R-018 closes.
Q4 2026
CONDITIONAL
Customer-support chatbot
Pending DPIA completion + [Vendor C] DPA finalization. Hold until both close. Then reconsider via standard intake.
Q4 2026
RESTRUCTURE
Public-facing customer recommendation engine
Current design exceeds risk appetite per Section 4. Revised scope in Section 9.3 reduces data-flow surface; resubmit through intake when revised design is ready.
2027 Q1+
Pages 45–47 · Appendices & Source Material
09 · Appendices & Source Material
- Appendix A. Regulatory framework mapping — full crosswalk to EU AI Act articles, NIST AI RMF functions, ISO/IEC 42001 clauses, and sector-specific overlays.
- Appendix B. Discovery interview log — list of stakeholders interviewed during the engagement (CEO, COO, GC, CTO, CISO, BU leads), interview dates, key findings per interview.
- Appendix C. Workshop decision log — every decision made during the Week 3 workshops, with attribution, rationale, and any minority opinions captured.
- Appendix D. Glossary — definitions of every AI-specific term used in the framework, calibrated to [Client]'s vocabulary.
- Appendix E. Templates — intake form, risk-register entry, decision log, vendor review checklist, exception register, quarterly review template, board attestation memo, insurer attestation form.