AI governance checklist
A one-page starting point for small funds and family offices. Not legal advice — confirm your obligations with counsel.
1. Policy
- Written staff AI policy: who may use which tools, for what, and what is prohibited.
- Separate agent policy: which actions an agent may take, and which need approval.
- Named owner for AI use and a route for questions and exceptions.
2. Inventory
- List of AI tools in use, the data they touch, the owner and the risk level.
- Which tools are approved, which are tolerated, which are banned.
- Vendors, hosting location and data-processing terms recorded.
3. Data boundaries
- What may and may not be entered into a model (client data, MNPI, personal data).
- Where data is processed (EU/EEA vs third countries) and under what safeguards.
- No client data used to train models without a lawful, agreed basis.
4. Human review
- High-stakes outputs (investor reporting, NAV, compliance) are reviewed by a person.
- Escalation path when a model output looks wrong or unusual.
- Decisions and approvals are logged.
5. Vendors and access
- Least-privilege access, time-limited and revoked at handover.
- Data-processing agreements and confidentiality in place.
- Subcontractors identified and approved.
6. Logging and audit trail
- Inputs, outputs and approvals are recorded for material workflows.
- Logs are retained for the agreed period and are retrievable.
- Incident process: who is told, how fast, and what is recorded.
7. Training and literacy
- All staff who use AI have had a basic literacy session.
- Role-specific guidance for investment, operations and compliance teams.
- Refresher at least annually.
8. Review cadence
- Policy and inventory reviewed at least annually, and after any material change.
- New tools assessed before use, not after.
- Regulatory dates tracked and confirmed with counsel.
Regulatory note: AI literacy obligations have applied since February 2025. High-risk AI obligations were moved to 2 December 2027 by the AI Omnibus (Council approval 29 June 2026). Confirm the final text and your classification with a lawyer.
Want this applied to your firm? Request a 20-minute call or email [email protected].