AI Deployer Governance Kit

Operational register of AI systems: discovery sources, role, EU AI Act category, internal risk tier, owners, review dates, decommissioning

Staff AI policy: approved tools, permitted and prohibited uses, prompt data rules, review, IP, disclosure, AI Act Art. 4/5/50, ISO 42001 A.2/A.9

AI literacy measures for staff and contractors: roles, competence levels, curriculum, records, assessment, refresh

AI supplier due diligence: tiering, provenance, data residency, OWASP LLM security, evals, bias, incidents, GPAI dependencies, Art. 25, scoring

FRIA for deployers of high-risk AI under EU AI Act Article 27: processes, affected groups, risks, oversight, notification

GAI risk profile: context, 12 NIST AI 600-1 risks rated, GV/MP/MS/MG actions by ID, residual risk, AI Act and 42001 crosswalk, monitoring

EU AI Act Art. 26 checklist for high-risk deployers: oversight staff, input data, monitoring, logs, worker notice, FRIA trigger, Art. 86 explanations

Human oversight: objectives, decision points (in, on, over the loop), approval gates, override and stop, overseer training, automation bias, UI, logs

AI incident or near miss: classification, Art. 3(49) serious incident test, timeline, harm, evidence, root cause, Art. 73 deadlines, notifications, CAPA