List the AI platforms, licences, and model endpoints your organization intends to use or already uses (clouds, SaaS AI features, self-hosted models).

The single most common gap. Without this, no policy above it holds.

Which network egress controls (proxy, firewall, SSE, SASE) are available for tagging and filtering traffic to model endpoints?

Set proxy or firewall filters for major LLM API endpoints and tag traffic by business unit.

Which CASB / SaaS discovery capability do you have available to surface shadow AI?

Employees route around bans within a week without a sanctioned path.

Which existing enterprise tools (CRM, ITSM, analytics, IDE, collaboration) have AI features you will need to review?

Features get switched on without an intake and become part of your estate.

What data classification scheme does your organization use, and which classes exist? (e.g. Public / Internal / Confidential / Regulated)

Governance follows data sensitivity, not enthusiasm for a use case.

Which DLP platform (Purview, Netskope, Zscaler, Symantec, other) is available or in place, and does it currently inspect the prompt path?

The major DLP platforms all inspect the prompt path now.

For each provider you plan to use, do you have (or can you negotiate) zero-data-retention terms?

Default APIs often retain data. Close it contractually, do not assume.

Do you require providers to contractually exclude your data from model training on the tier you will purchase?

Consumer terms and some enterprise tiers still permit provider use for model improvement.

Which sanctioned Tier 1 tools do you want to offer employees for day-to-day AI use?

If the sanctioned tool is painful and the public one is easy, you lose.

How will you require teams building custom RAG or agent applications to register their use case?

Registered use, not ungoverned use.

What Tier 3 use cases (customer-facing, autonomous, high-value decision) are on your near-term roadmap that will require a full review?

Tier 3 is where the actual damage lives.

How will you ensure the sanctioned path is the path of least resistance for employees (SSO, defaulted tools, one-click access)?

Behavioral truth. If the safe path is painful, adoption collapses.

Should the intake form capture use case and decision authority explicitly? (Recommended: yes.)

Advisory and autonomous systems carry very different risk.

Which data classes do you expect AI use cases will touch on input, output, and any fine-tuning?

Fine-tuning bakes data into weights and cannot be unlearned cleanly.

For each use case, will you require model selection, hosting region, and retention terms to be recorded?

You cannot audit what you did not record.

For each expected use case, where should humans be inserted for review or approval?

HITL is a control only if it is documented and enforced.

Will you require every AI use case to name a kill-switch owner and document a rollback procedure?

A kill switch without a named owner is a claim, not a control.

Which of your intended use cases touch HR, lending, healthcare, legal, or other domains where bias and fairness are automatically in scope?

Automatic yes for HR, lending, healthcare, legal.

Which identity platform (Entra ID, IAM roles, Workload Identity) will you use to give each agent its own least-privilege identity?

Without this, everything else in this section is unenforceable.

Which agent actions will you permit, and where will you enforce allowlists and rate limits?

Blast radius is set here.

How will you handle untrusted content reaching your models, and what is the maximum permitted blast radius if injection succeeds?

The right question is: what does the agent lose access to when it happens?

Which log platform (SIEM, log analytics) will hold prompts, responses, tool calls, and retrieval; what retention; and how will you access-control the log data?

The logs will contain the same regulated data as the prompts. Treat them accordingly.

What per-agent and per-tenant rate and spend limits will you enforce, and at which layer?

Unbounded consumption is both a cost problem and a DoS risk.

Where will you validate, sandbox, or sanitise model outputs before acting on them or rendering them?

Do not eval() model output. Do not run generated SQL without a read-only role.

Which evaluation tooling (Promptfoo, custom harnesses, Azure AI evals, Bedrock evals) will you use to run scheduled regressions on prompts and models?

A launch red team is a snapshot, not evaluation. Models drift.

What AI-specific questions should your vendor questionnaire include? (Provider, training use, retention, sub-processors, evaluations, change notice.)

Every SaaS vendor now claims to be AI-powered.

Which self-hosted models (if any) will you run, and what artefact scanning will you apply?

HuggingFace pickle exploits are real. This is a documented supply chain vector.

Will you require notice, rollback, and re-evaluation rights when providers rev their models?

Providers rev their models. Your paper should keep pace.

How will you assign a single accountable owner per deployed AI system?

This is the Govern function of NIST AI RMF in one sentence.

How will you identify and empower AI champions in each business unit?

They know the real use cases before central governance does.

Which training tracks will you build for (a) all staff, (b) developers, (c) executives?

Same skill areas, three different depths.

Does your organization offer AI services or products that touch users in the EU, and if so which risk categories apply?

Prohibited and GPAI rules are already enforceable. High-risk timing may shift under the Digital Omnibus package; verify current status.

Do you want the resulting policy explicitly cross-referenced to NIST AI RMF (AI 100-1) and the Generative AI Profile (AI 600-1)?

Voluntary framework, but de facto US baseline and often required in federal contracts.

Which sectors and jurisdictions do you operate in that will bring AI-specific obligations?

The state-level list grows quarterly. Map only what touches you.

Are you planning to pursue ISO 42001 certification, and on what timeline?

Worth pursuing if you want a certifiable AI management system.

Which AI-specific incident scenarios do you want playbooks drafted for?

Assume something will go wrong and rehearse it.

How will you require the kill switch for every autonomous agent to be documented and tested on a schedule?

An untested kill switch is a claim, not a control.

Will you commit to at least one annual AI-incident tabletop that includes legal and communications?

The response is as much legal and reputational as it is technical.

Which storage and process will you use to preserve model version, system prompt, tool config, and session logs at the moment of an incident?

Providers roll models forward. If you did not capture state, you cannot reconstruct what happened.

Which activity metrics do you want the policy to require reporting on?

Activity metrics tell you the program is running.

Which outcome metrics do you want the policy to require reporting on?

Outcome metrics tell you the program is working. Cost per BU makes finance an ally.

Which of the weeks-1-to-4 baseline actions do you already have in place, and which need to be commissioned?

The foundation that everything else assumes.

Which of the months-2-to-3 milestones are realiztic on that timeline for you?

The point at which the program becomes operational.

Which quarter-2 milestones can you commit to?

The point at which the technical controls become the enforced default.

What ongoing cadence will you commit to for vendor, board, and regulatory reviews?

The bit programmes forget to build.

Are you at risk of publishing policy before completing discovery?

A published policy over an unmapped estate is decoration.

Do you plan to enforce a ban without offering employees a sanctioned alternative?

Employees route around bans within a week.

Will you commit to continuous vendor assurance rather than a one-off gate?

AI features ship monthly. Assurance has to keep pace.

Will you resource ongoing evaluations, not just launch red teams?

Models drift. A one-time review ages out in weeks.

Will you require drilled, not just documented, kill switches?

If no one has pulled it in a drill, it does not exist.

Will your policy focus effort on the surfaces around the model rather than on model prompting alone?

Prompt engineering does not compensate for missing identity, logging, or allowlists.