Make governance sustainable. A small, regular review rhythm is more useful than a large annual exercise that nobody owns.
Purpose
AI governance becomes part of ordinary business management, with clear triggers for review when systems, purposes, suppliers or rules change.
Recommended timing
Ongoing · Indicative timing. Adjust to the organisation’s size, complexity and available capacity.
What to do
- Maintain the AI inventory when new systems are acquired, new features are enabled or existing uses materially change.
- Review priority assessments when the intended purpose, model, data, users, affected people or operating context changes.
- Review incidents, complaints, exceptions and emerging risks at the appropriate governance forum.
- Monitor relevant regulatory developments and update internal guidance when a change affects the organisation.
- Provide refresher awareness and role-specific training when needed.
- Review the effectiveness of the governance arrangements at least annually, or sooner after significant change or incident.
- Retire obsolete records and tools in line with the organisation’s retention and information-management rules.
Meetings to arrange
Use these default meeting formats. Combine meetings or shorten them where the same people are involved and the decisions can be made together.
Monthly operational review
Duration: 30–45 minutes
Attendees: Programme lead and relevant control owners.
Agenda: Review new AI use, changes, incidents, exceptions, overdue actions and regulatory updates.
Expected output: Updated inventory, action log and escalation list.
Quarterly governance review
Duration: 60 minutes
Attendees: Executive sponsor or delegated committee, programme lead and relevant senior functions.
Agenda: Review portfolio trends, priority risks, policy exceptions, training, supplier issues and material changes.
Expected output: Documented oversight, decisions and actions.
Annual effectiveness review
Duration: 60–90 minutes
Attendees: Executive sponsor, programme lead, risk/compliance, IT, security, privacy and business representatives.
Agenda: Check whether roles, processes, records and controls remain proportionate and effective; agree improvements.
Expected output: Updated annual plan and governance review record.
Decisions to make
- Has the organisation’s AI use changed materially?
- Are current policies, controls and responsibilities still appropriate?
- Are unresolved issues being escalated and closed?
- Do regulatory or business changes require a revised programme?
Definition of done
- Current AI inventory and governance records.
- Regular management reporting and decision records.
- Annual review and improvement plan.
- Documented triggers for reassessment.
Keep it proportionate
Use existing roles, committees and processes wherever they work. Do not create a new approval layer or collect more information than is needed to make a sound decision.
Resources to use
Use the relevant Lucentreg resources at this point in the programme: the communications templates, simplified AI usage questionnaire, integrated governance workbook, assessment guidance, policy template, committee terms of reference and worked examples. Download blank resources, then maintain completed records in your organisation’s own approved environment; Lucentreg does not need to receive your operational data.
Important: Lucentreg provides educational and operational guidance, not legal advice or a determination of compliance. Screening prompts and suggested actions are starting points. Your organisation remains responsible for its decisions and should obtain qualified legal or technical advice where appropriate.