How to Build an AI Governance Program: a records-based guide for organizations that use AI.

Built for the executive who has to answer AI questions in writing.

Most organizations now facing AI governance questions did not choose the timing. The questions arrive from outside: an AI clause in a customer contract, a question on a cyber insurance renewal, a due diligence questionnaire, a flowdown from a prime, or a statute that reaches the organization through the residents its systems affect. The paper opens with the question executives ask first, why build now when the rules keep moving, and answers it with the record: the statutes have churned while the frameworks underneath them held still, and one state has written framework compliance into its statutory defense structure. Waiting is not neutral, because representations are being made during the wait.

The paper then builds the program's five components in sequence, each defined by the records it produces: the AI use inventory, the use policy, framework alignment, vendor and embedded AI oversight, and sustainment. It closes with the program at working scale, a profile of what each component looks like at a fifty person manufacturer, and a one page build sequence that can be handed to whoever will own the work. The scope is deliberate: this is the deployer and user version of the program, for organizations that buy and use AI rather than developing it, which is the honest scope for most small and midsize companies.