AI Governance is a new Governance 360 module that helps you find every AI system you use, assess its risk, prove your controls are in place, and report one clear picture to your board and examiners.
You don't start from a blank page. The module builds your AI inventory from the System Map you already maintain: tick Uses AI on a system, and it becomes an AI system ready to assess. No new spreadsheet, and no AI expertise required. The questions are written in plain language for a non-technical assessor, and the hardest ones go to the vendor.
See the AI Governance Overview Guide here.
What you can do with it
Inventory, not a survey. See every system that uses AI, yours and your vendors', in one place. Each is classified by what it does (internal, customer-facing or decisioning) and by the data it can reach.
Tier every use case the way examiners expect. Each way you use AI gets its own use case record, modeled section for section on the CSBS AI Use Case Risk-Tiering Worksheet. You rate consumer impact, human oversight, harm potential and data sensitivity, and the highest factor sets the risk tier. The controls suggested for that tier appear right in the form.
Ask the vendor, without the back-and-forth. Send a vendor questionnaire link in a couple of clicks. Your vendor answers online with no login, covering data quality, privacy, security, compliance, bias and fairness, transparency, human oversight and hallucination risk. You review their answers side by side with yours, then apply them.
Document your institution's AI controls. Track your own AI governance controls, influenced by the NIST AI RMF, with evidence and dates tested. Each control shows how it relates to CIS v8.1 and NIST CSF 2.0. A Finosec AI Policy Template is available in Governing Documents to get your policy started.
Risk you can explain. Inherent risk comes from what each system does and the data it touches. Vendor controls, use case controls and your institution-wide governance controls then bring it down to a residual risk you can walk an examiner through.
Approvals, reviews and history on file. Use cases move from draft to submitted to approved, and every approval is kept. Review dates follow the risk level, with reminder emails before anything goes overdue.
Reports on demand. Generate a comprehensive AI governance report, a board risk summary, a system inventory and risk report, a vendor and system report, a gap report, a use case decisioning log, and completed risk-tiering worksheets laid out like the CSBS worksheet.
Why it matters
Inventory first. Everything defensible follows from it. Answer "where is AI used?" first, and your policy, risk assessment and board report all have something underneath them. Answer it late, and you are writing governance for systems you haven't found yet.
Don't wait for the guidance to settle. Every framework starts with an inventory. It's the one step no future guidance will invalidate.
Show a program that's being worked. The gaps already exist; today they're just undocumented. Residual risk scoring shows you what to fix first and shows examiners a program in motion, not a policy on a shelf.
Built on what you already use. AI Governance connects to the System Map, Vendor Governance, IS Controls, Governing Documents and the Exam Readiness dashboard, so you don't enter the same information twice.
