AssureCore resource
A practical introduction to AI governance
What to document before an AI system becomes a business-critical process.
Start with an inventory
List the AI systems your organisation uses or provides, who owns each one, what data it touches, and which decisions it influences. Include vendor tools and embedded features, not only models built in-house.
Make risk and accountability visible
Record intended use, known limitations, human oversight, security controls, and incident paths. ISO 42001 and the NIST AI RMF offer different but complementary ways to structure this work; the EU AI Act adds obligations based on system risk and role.
Review before relying
AI-assisted analysis can help teams find patterns and draft work, but people remain responsible for checking accuracy, context, and suitability. Treat generated output as a work product to review, not as legal, audit, or compliance advice.
Resource note
This resource is provided for education and planning. It is not legal advice, an audit opinion, a customer claim, or a promise of a particular compliance result.