THE STARTING POINT
Three things to get right.
- Document each AI use case, data source, owner, and intended action.
- Record risk decisions with reviewers and review dates.
- Keep evidence of how a control operates, not just that it exists.
TRY THIS IN THE LAB
A question worth testing.
Build a one-page inventory for an internal assistant. Name its data owner, approved audience, permitted actions, evaluation criteria, and retirement trigger.
Browse the lab notesLeave a useful trail.
Write down your starting assumptions, scope, expected behavior, observed behavior, and evidence. A successful test should explain what happened and which question to investigate next.