The Executive Checklist to Assess AI Governance: 20 Questions in 5 Blocks
By Pedro Sonda, dooop
To evaluate a company’s AI governance, an executive needs answers, supported by evidence, for five blocks of questions: responsibility (who is accountable), visibility (which AI is in use and with what data), risk (how uses are assessed before starting), control (which safeguards operate daily), and monitoring (how leadership views results and incidents). Having a written policy is only the beginning. Governance exists when answers can be demonstrated, not just asserted.
Updated October 2026.
Why Evaluate Now
| Data | Source |
|---|---|
| 63% of organizations that suffered data breaches had no AI governance policy or were still developing one; one in five reported breaches linked to shadow AI (unauthorized AI use) | IBM, 2025 |
| Among organizations reporting breaches of AI models or applications, 97% lacked adequate AI access controls | IBM, 2025 |
| Only 40% of employees say there is policy or guidance on generative AI at work, and nearly half admit to using AI in ways that violate company rules | KPMG and University of Melbourne, 2025 |
| Only 25% of respondents in a Gartner survey indicated having a clear AI accountability role | Gartner, 2024 |
Interpretation: The most common gap is not the absence of technical rules but the lack of clear accountability and visibility over actual use. These two points are precisely what an executive can verify.
dooop Framework: The Checklist in 5 Blocks
Answer "yes, with evidence," "partially," or "no."
Block 1: Responsibility
| # | Question | Expected Evidence |
|---|---|---|
| 1 | Is there a person responsible for AI governance with a formal mandate? | Registered appointment; defined scope |
| 2 | Is it clear who approves new AI uses? | Documented approval workflow |
| 3 | Does each AI solution in operation have a business owner? | Owner indicated in inventory |
| 4 | Is AI governance regularly on the agenda of the board and executive committee? | Meeting minutes or agendas |
Block 2: Visibility
| # | Question | Expected Evidence |
|---|---|---|
| 5 | Is there an inventory of AI uses, including market tools? | Inventory updated within last 90 days |
| 6 | Do we know what data enters each tool? | Data classification by use |
| 7 | Do we know how much use occurs outside approved tools? | Anonymous survey or monitoring |
| 8 | Do suppliers disclose where they use AI in services provided? | Clauses or questionnaires |
Block 3: Risk
| # | Question | Expected Evidence |
|---|---|---|
| 9 | Does every new use undergo a proportional risk assessment? | Assessment form or record |
| 10 | Do uses affecting customers, money, or decisions about people have stricter criteria? | Classification by risk level |
| 11 | Do automated decisions affecting people allow for review? | Review process (LGPD provides the right to request review of automated decisions, art. 20) |
| 12 | Are AI risks included in the corporate risk map? | Entry in risk map |
Block 4: Control
| # | Question | Expected Evidence |
|---|---|---|
| 13 | Is there a usage policy known to employees? | Published policy; acknowledgment or training records |
| 14 | Are there access controls for AI tools and data used? | Access configurations and profiles |
| 15 | Is it defined where human review is mandatory? | Review points by process |
| 16 | Is there a record of incidents involving AI? | Incident channel and log |
Block 5: Monitoring
| # | Question | Expected Evidence |
|---|---|---|
| 17 | Does leadership receive periodic reports on uses, risks, and incidents? | Quarterly report |
| 18 | Are AI initiative results measured against promised outcomes? | Indicators by initiative |
| 19 | Are the policy and inventory reviewed at defined intervals? | Review dates |
| 20 | Do we use any recognized reference to guide governance? | Mapping to NIST AI RMF, ISO/IEC 42001, or similar |
How to Interpret the Results
| Result | Interpretation | Priority |
|---|---|---|
| Blocks 1 and 2 "no" | Governance does not exist in practice | Appoint responsible person, publish minimum policy, and build inventory within 30 days |
| Blocks 1 and 2 ok; 3 and 4 weak | Declared governance | Proportional risk assessment and controls on higher-risk uses |
| Blocks 1 to 4 ok; 5 weak | Governance without management cycle | Quarterly reporting and periodic review |
| Majority "yes, with evidence" | Governance in operation | Align with recognized references and prepare for regulation |
Helpful References
- NIST AI Risk Management Framework: organizes AI risk management into functions of govern, map, measure, and manage.
- ISO/IEC 42001: AI management system standard, useful for companies seeking certification.
- LGPD: already applies to personal data used by AI.
For what to do with higher-risk uses, see How to Assess Risk Before Developing an AI Use Case. For daily employee rules, see How to Create Criteria for Safe AI Use by Employees.
What to Do Now
- Answer the 20 questions with the technology lead and the risk or legal lead.
- Request evidence for each "yes."
- Choose three gaps to close within 90 days, starting with blocks 1 and 2.
To structure AI governance with responsibilities and proportional controls, explore the dooop AI Governance practice.
Frequently Asked Questions
Do medium-sized companies need this entire structure? They need the answers, not a large structure. A part-time responsible person, a one-page policy, an inventory spreadsheet, and quarterly review already address most questions.
Who should apply the checklist? The board, supported by technology, legal, and risk teams. The board may request answers as part of its oversight.
Is having an AI policy enough? No. The policy answers only one of the 20 questions. Without responsibility, inventory, and controls, it tends to remain on paper.
Also Read
About dooop
dooop is a consultancy based in Caxias do Sul (RS) that prepares leaders and organizations to transform artificial intelligence into business capability through strategy, governance, and training.