Build an AI Governance Program

Design a governance charter, RACI, policy hierarchy, and intake workflow.

Introduction

30 Second Summary

Most organizations treat AI governance as a stack of PDFs. When a regulator asks for evidence, teams scramble to document what was never tracked. The result is expensive, fragile, and always out of date.

In this project, you will build a complete AI governance operating model as machine-readable infrastructure. You'll create a governance charter, risk register, control library, and compliance evidence pipeline that can be validated programmatically.

What You'll Build

An enterprise AI governance program that treats policies, risk assessments, and regulatory evidence as code rather than static documents.

By the end of this project, you'll have:

  • A governance charter with committee structure, RACI matrix, and policy hierarchy that defines decision rights across your organization.
  • A risk register and control library mapped to ISO/IEC 42001 and NIST AI RMF that enforces policy compliance with OPA Rego rules.
  • A Fundamental Rights Impact Assessment aligned to EU AI Act Article 27 requirements, with machine-readable evidence exported in OSCAL format.
  • Secret Mission: Extend your governance program with an automated AI system intake workflow that routes approval requests by risk tier.

Are there any prerequisites?

No coding experience is required. You'll use Cursor's coding agent to build the program infrastructure. Familiarity with AI governance concepts (such as those covered in the IAPP AIGP certification) is helpful but not necessary.

Define Your Governance Framework

Every AI governance program starts with a framework document that sets the boundaries for everything that follows.

In this step, you'll create a governance framework file that defines your core principles, scope, and objectives. These three elements form the foundation that your policies, controls, and review processes will build on.

In this step, get ready to:
  • Create a governance framework document.
  • Define core principles for responsible AI use.
  • Establish the scope and objectives of your governance program.
Create the framework file and define principles

A governance framework needs a clear set of principles that guide every decision about AI systems. These principles act as guardrails for your organization.

  • In your text editor, create a new file called governance-framework.md.
  • Add the framework header and principles section by pasting in the following code:
# AI Governance Framework

## Principles
- Transparency
- Accountability
- Fairness
- Safety

What do these principles mean?

Each principle maps to a concrete governance requirement.

  • Transparency means stakeholders can understand how AI systems make decisions.
  • Accountability means clear ownership exists for every AI system's outcomes.
  • Fairness means AI systems do not produce discriminatory or biased results.
  • Safety means AI systems operate within defined risk boundaries and fail gracefully.
  • Save governance-framework.md.
  • Confirm the file exists by checking your file explorer or editor sidebar. You should see governance-framework.md listed.

Don't see the file?

Make sure you saved the file with the exact name governance-framework.md including the .md extension. Check that you saved it in the folder you intended.

Still stuck? Help me find my governance-framework.md file

Add the scope and objectives

Principles tell you what you value. Scope tells you where those values apply, and objectives tell you what success looks like.

  • In governance-framework.md, add the scope and objectives sections below the principles by pasting the following:
## Scope
This framework applies to all AI systems developed and deployed within the organization.

## Objectives
- Ensure ethical AI use
- Maintain compliance with regulations
- Enable continuous monitoring and improvement

What does this section do?

The Scope section establishes that every AI system in the organization falls under governance. This prevents teams from claiming their system is exempt.

The Objectives section defines measurable goals. Compliance with regulations, ethical use, and continuous improvement give you concrete things to evaluate against.

  • Save governance-framework.md.
  • Review the file in your editor. You should see three sections: Principles (with four bullet items), Scope (with a single paragraph), and Objectives (with three bullet items).

Formatting looks off?

Make sure there is a blank line between the end of the Scope paragraph and the ## Objectives heading. Markdown requires blank lines between sections to render headings correctly.

Need more help? Help me fix the formatting in my governance-framework.md file

✔️ Awesome, I've got everything!

Great. Double check you've saved your file.

ⓧ I'd like to double check the full code

Here is the complete governance-framework.md file for comparison:

# AI Governance Framework

## Principles
- Transparency
- Accountability
- Fairness
- Safety

## Scope
This framework applies to all AI systems developed and deployed within the organization.

## Objectives
- Ensure ethical AI use
- Maintain compliance with regulations
- Enable continuous monitoring and improvement

Your governance framework is in place. Next up, you'll build on this foundation by defining the policies and controls that turn these principles into enforceable requirements.

Build Your Policy Infrastructure

Your governance framework establishes the principles and scope for responsible AI use. Now it's time to translate those high-level commitments into actionable policy documents.

Operational policies are the enforceable rules that teams follow day-to-day. In this step, you'll create three policies covering data usage, model deployment, and risk management.

In this step, get ready to:
  • Create a dedicated policies directory to house your operational documents.
  • Write data usage and model deployment policies.
  • Write a risk management policy.
Create the policies directory

Policies need a dedicated home separate from the framework document. A policies/ directory keeps each policy as its own versioned file.

  • Create the policies directory by running this command in your terminal:
mkdir policies
  • Confirm the directory was created by running:
ls

You should see policies listed alongside your existing governance-framework.md file.

Write the data usage and model deployment policies

Each policy targets a specific operational domain. The data usage policy governs how teams collect, store, and handle data. The model deployment policy sets standards for releasing AI models into production.

  • Create a new file called policies/data-usage-policy.md and add the following content:
# Data Usage Policy

## Purpose
Define acceptable use of data in AI systems.

## Rules
- Data must be collected with consent
- Data must be anonymized where possible
- Data retention limits must be enforced

What does this policy cover?

The data usage policy addresses three pillars of responsible data handling. Consent ensures individuals know their data is being used. Anonymization protects identities. Retention limits prevent data from being held indefinitely without purpose.

  • Save policies/data-usage-policy.md.
  • In your editor's file explorer, confirm that data-usage-policy.md appears inside the policies folder.

Don't see the file in the policies folder?

Make sure you created the file inside the policies/ directory, not in the project root. The path should be policies/data-usage-policy.md.

Also check for typos in the filename. It should be data-usage-policy.md with hyphens, not underscores.

Help me find where my policy file ended up

  • Create a new file called policies/model-deployment-policy.md and add the following content:
# Model Deployment Policy

## Purpose
Establish standards for deploying AI models.

## Rules
- All models must pass bias and fairness checks
- Models must be versioned and documented
- Rollback procedures must be in place

Why require bias checks before deployment?

Bias and fairness checks act as a gate before any model reaches production. Without them, a model trained on skewed data could produce discriminatory outcomes at scale.

Versioning and rollback procedures ensure you can revert to a previous model if issues are discovered post-deployment.

  • Save policies/model-deployment-policy.md.
  • Confirm that model-deployment-policy.md now appears alongside data-usage-policy.md in the policies folder.
Write the risk management policy

The risk management policy ties everything together. It requires teams to assess risk before deployment and establishes a feedback loop for incidents.

  • Create a new file called policies/risk-management-policy.md and add the following content:
# Risk Management Policy

## Purpose
Identify and mitigate risks associated with AI systems.

## Rules
- Risk assessments must be conducted before deployment
- High-risk systems require additional review
- Incidents must be logged and reviewed

What does this policy do?

This policy creates a pre-deployment gate (risk assessments), an escalation path (additional review for high-risk systems), and a post-deployment feedback loop (incident logging). Together, these three rules close the lifecycle from planning through monitoring.

  • Save policies/risk-management-policy.md.
  • Verify all three files exist by running:
ls policies

You should see data-usage-policy.md, model-deployment-policy.md, and risk-management-policy.md listed in the output.

Missing one or more policy files?

Double check that each file was saved inside the policies/ directory. If a file was accidentally saved at the project root, move it into policies/ using your editor or a terminal command.

Help me find my missing policy files

✔️ Awesome, I've got everything!

Great. Make sure all three policy files are saved before moving on.

ⓧ I'd like to double check the full code

Here are all three policy files for comparison:

# Data Usage Policy

## Purpose
Define acceptable use of data in AI systems.

## Rules
- Data must be collected with consent
- Data must be anonymized where possible
- Data retention limits must be enforced
# Model Deployment Policy

## Purpose
Establish standards for deploying AI models.

## Rules
- All models must pass bias and fairness checks
- Models must be versioned and documented
- Rollback procedures must be in place
# Risk Management Policy

## Purpose
Identify and mitigate risks associated with AI systems.

## Rules
- Risk assessments must be conducted before deployment
- High-risk systems require additional review
- Incidents must be logged and reviewed

Your policy infrastructure is in place. You now have enforceable rules covering how data is handled, how models reach production, and how risks are managed. Next up, you'll connect these policies to specific controls and accountability structures.

Create Monitoring and Audit Mechanisms

Policies define what should happen, but without monitoring, you have no way to confirm that reality matches intent.

In this step, you will build the operational mechanisms that make your governance framework observable. You will create an audit checklist that verifies compliance before and after deployment, and an incident response procedure that defines exactly what happens when something goes wrong.

In this step, get ready to:
  • Create an audit checklist covering pre-deployment and post-deployment checks.
  • Define an incident response procedure with clear escalation steps.
Create the monitoring directory and audit checklist

An audit checklist provides a repeatable set of verification steps that reviewers follow each time an AI system is assessed. Without one, audits become inconsistent and gaps slip through.

  • Create a new folder called monitoring inside your project directory by running this command:
mkdir monitoring
  • Create the audit checklist file by running:
touch monitoring/audit-checklist.md
  • Confirm the file exists by running:
ls monitoring

You should see audit-checklist.md in the output.

  • Open monitoring/audit-checklist.md in your text editor and add the following content:
# AI Audit Checklist

## Pre-Deployment
- [ ] Risk assessment completed
- [ ] Bias and fairness evaluation done
- [ ] Documentation reviewed

## Post-Deployment
- [ ] Performance metrics logged
- [ ] Incident reports reviewed
- [ ] Compliance status confirmed

What does this checklist do?

The checklist is split into two phases. Pre-Deployment items confirm that governance requirements are met before a model goes live. Post-Deployment items verify ongoing compliance after the system is in production.

Each checkbox maps back to a rule in your policies. For example, "Risk assessment completed" ties directly to the risk management policy you created earlier.

  • Save monitoring/audit-checklist.md.
  • Verify the file contents by opening it in your editor. You should see two sections with three checkbox items each.

File not appearing in the monitoring folder?

Make sure you created the monitoring directory first. The touch command will fail silently if the parent directory does not exist.

help me find my audit checklist file

Create the incident response procedure

When an AI system behaves unexpectedly, your team needs a predefined sequence of actions. An incident response procedure removes ambiguity during high-pressure moments by telling people exactly what to do and in what order.

  • Create the incident response file by running:
touch monitoring/incident-response.md
  • Open monitoring/incident-response.md in your text editor and add the following content:
# Incident Response Procedure

## Steps
1. Detect and log the incident
2. Assess severity and impact
3. Notify relevant stakeholders
4. Contain and remediate
5. Conduct post-incident review

What does each step accomplish?

Step 1 ensures the incident is captured in a log immediately. Step 2 determines how urgently the team needs to act. Step 3 brings the right people in based on severity.

Steps 4 and 5 handle resolution and learning. The post-incident review is critical because it feeds improvements back into your policies and audit checklist.

  • Save monitoring/incident-response.md.
  • Confirm both monitoring files exist by running:
ls monitoring

You should see both audit-checklist.md and incident-response.md listed in the output.

Only seeing one file?

Double check that you ran the touch command with the correct path including the monitoring/ prefix. If the file was created in the wrong location, move it with mv incident-response.md monitoring/.

help me fix my monitoring folder structure

Why separate monitoring from policies?

Policies define rules. Monitoring verifies those rules are being followed. Keeping them in separate directories reflects how organizations actually operate. The policy team writes the rules, and the operations team runs the audits against them.

✔️ Awesome, I've got everything!

Great. Double check you have saved both files in your monitoring folder.

ⓧ I'd like to double check the full code

Here is the complete content for both monitoring files.

# AI Audit Checklist

## Pre-Deployment
- [ ] Risk assessment completed
- [ ] Bias and fairness evaluation done
- [ ] Documentation reviewed

## Post-Deployment
- [ ] Performance metrics logged
- [ ] Incident reports reviewed
- [ ] Compliance status confirmed
# Incident Response Procedure

## Steps
1. Detect and log the incident
2. Assess severity and impact
3. Notify relevant stakeholders
4. Contain and remediate
5. Conduct post-incident review

Your governance program now has teeth. Policies set the expectations, and your monitoring mechanisms verify those expectations are met. Next, you will tie all of these pieces together into a cohesive operating model.

Embed Governance Into Your Workflow

You now have a governance framework, operational policies, and a monitoring plan. These are powerful documents on their own, but they only deliver value when teams actually use them at the right moments.

In this step, you'll create a workflow integration guide that maps your governance checkpoints directly onto the AI development lifecycle. This transforms governance from a static set of documents into actionable triggers that fire at each stage of building and deploying AI.

In this step, get ready to:
  • Create a workflow integration guide that connects governance to the AI development lifecycle.
  • Map each lifecycle stage to specific governance actions from your existing documents.
Create the workflow directory

Your governance documents live in separate folders by concern. The workflow integration guide needs its own directory because it serves a different purpose: connecting all the other documents into a single operational flow.

  • Create the workflow directory inside your project folder by running this command:
mkdir workflow
  • Create the integration guide file by running:
touch workflow/governance-integration-guide.md
  • Confirm the file exists by running:
ls workflow
  • You should see governance-integration-guide.md in the output.
Write the governance integration guide

The integration guide maps each stage of the AI development lifecycle to concrete governance actions. Each checkpoint references documents you already created, so teams know exactly which policy or checklist to pull up at each moment.

  • Open workflow/governance-integration-guide.md in your text editor.
  • Copy the following content into the file:
# Governance Integration Guide

## AI Development Lifecycle Checkpoints

### Ideation
- Review governance framework alignment

### Data Collection
- Apply data usage policy

### Model Development
- Conduct bias and fairness checks

### Pre-Deployment
- Complete audit checklist
- Perform risk assessment

### Post-Deployment
- Monitor performance
- Log and review incidents

What does this guide do?

Each lifecycle stage maps directly to one of your existing governance documents.

  • Ideation references your governance framework's principles and scope. Before any work begins, the team checks alignment.
  • Data Collection triggers the data usage policy, ensuring consent and anonymization rules are followed.
  • Model Development activates the bias and fairness checks from your model deployment policy.
  • Pre-Deployment pulls in the audit checklist and risk management policy for final sign-off.
  • Post-Deployment connects to the monitoring plan and incident response procedure.
  • Save workflow/governance-integration-guide.md.
  • Verify the file is saved correctly by opening it and confirming you see the five lifecycle stages (Ideation, Data Collection, Model Development, Pre-Deployment, Post-Deployment) each with their governance actions listed below them.

File looks empty or formatting is off?

  • Make sure you saved the file after pasting the content. Unsaved changes won't persist.
  • Check that each heading uses the correct number of # symbols. The main title uses one, the section heading uses two, and lifecycle stages use three.

Help me fix my governance integration guide formatting.

✔️ Awesome, I've got everything!

Great. Double check you've saved your file.

ⓧ I'd like to double check the full code

Here is the complete file for comparison:

# Governance Integration Guide

## AI Development Lifecycle Checkpoints

### Ideation
- Review governance framework alignment

### Data Collection
- Apply data usage policy

### Model Development
- Conduct bias and fairness checks

### Pre-Deployment
- Complete audit checklist
- Perform risk assessment

### Post-Deployment
- Monitor performance
- Log and review incidents

Why embed governance into the lifecycle?

Most governance programs fail because they exist as standalone documents that teams forget about. By mapping checkpoints to specific lifecycle stages, governance becomes a natural part of the build process rather than a separate compliance exercise.

When a team reaches the Pre-Deployment stage, they don't have to guess what governance requires. The integration guide points them directly to the audit checklist and risk assessment they need to complete before moving forward.

Your governance program is no longer just a collection of policies. It's an integrated system with clear touchpoints at every stage of AI development. Next up, you'll bring everything together and validate your full governance infrastructure.

Secret mission

Build a Governance Maturity Scorecard

You've built the governance infrastructure. But how do you know if it's actually working? In this secret mission, you'll create a scorecard that measures your governance program's maturity across five dimensions, giving you a repeatable way to track improvement over time.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally, so there are no ongoing costs. Decide whether to keep your governance files for future reference, or delete them entirely.

Resources you created:

  • Local governance framework file (governance-framework.md).
  • Local governance scorecard file (governance-scorecard.md).
  • Local policies directory (policies/) with data usage, model deployment, and risk management policies.
  • Local monitoring directory (monitoring/) with audit checklist and incident response procedure.
  • Local workflow directory (workflow/) with governance integration guide.

Keep everything running

No action needed. Choose this if you plan to continue building on your governance infrastructure or want to reference your policies and framework later.

  • Your governance files stay on your machine and take up minimal disk space.
  • You can revisit and update your framework, policies, and scorecard as your governance program matures.

Pause - I'll come back to this later

Since this project is entirely local files, there is nothing to pause. Your files will remain on disk until you decide to delete them.

  • Close any open files in your text editor.
  • Your governance documents will be here when you return.

Delete - I don't want to use this again

Remove all project files to start fresh. This permanently deletes your governance framework, policies, monitoring documents, workflow guide, and scorecard.

On macOS or Linux, navigate to the parent directory containing your project files and run:

rm governance-framework.md governance-scorecard.md
rm -rf policies/ monitoring/ workflow/

On Windows, open the folder containing your project files in the terminal and run:

del governance-framework.md, governance-scorecard.md
rmdir /s /q policies
rmdir /s /q monitoring
rmdir /s /q workflow
  • Confirm deletion by running ls (macOS/Linux) or dir (Windows). You should no longer see governance-framework.md, governance-scorecard.md, policies/, monitoring/, or workflow/ listed.

Nice Work!

Nice Work!

You just built a complete AI governance program as living infrastructure. This is not a compliance binder sitting on a shelf. It is a working system of policies, monitoring processes, and workflow integrations that govern AI systems throughout their lifecycle.

Here's what you accomplished:

  • Built an AI governance framework with principles, scope, and objectives that anchor every downstream policy and process.
  • Created operational policies for data usage, model deployment, and risk management that translate principles into enforceable rules.
  • Designed monitoring and audit infrastructure with pre-deployment checklists, incident response procedures, and a governance scorecard to measure program maturity over time.
  • Secret Mission: Extended your governance infrastructure with additional automation or integration to strengthen the operating model.

Ready to quiz yourself?