AI & Data Governance

1There is a named data owner or data governance lead who is accountable for data policy, standards, and compliance across the organisation.

2We have a documented data governance framework, covering data ownership, classification, and acceptable use.

3Data quality is defined, measured, and reported regularly - we know how complete, accurate, and timely our critical datasets are.

4We can trace the origin, transformation, and movement of our critical datasets - data lineage is documented and kept current.

5We have a documented and enforced data retention and deletion policy - personal data is removed or anonymised when it reaches the end of its retention window.

6Privacy Impact Assessments (PIAs or DPIAs) are conducted before new AI initiatives, data products, or significant changes to how personal data is processed.

7AI models go through a documented review and approval process before deployment - covering purpose, performance benchmarks, and a named accountable owner.

8AI models in production are continuously monitored for performance degradation, changes in output patterns, and business outcome metrics.

9We have published AI ethics principles or a responsible AI policy that guides how AI is developed, procured, deployed, and monitored across the organisation.

10AI models are assessed for bias before deployment.

11We assess third-party suppliers that embed AI in our products or services against our governance standards before onboarding them.

12Our contracts with AI vendors include provisions for transparency, audit rights, data handling obligations, and the right to exit if the system causes harm or regulatory non-compliance.

13Training datasets are documented, including source, date range, and known gaps or biases.

14All data used to train or fine-tune AI models has a documented legal basis - consent, licensing, or legitimate interest.

15We have assessed and documented whether any AI systems we develop or deploy fall under the EU AI Act's high-risk or general-purpose AI categories, with justification for the classification.

16For any high-risk AI systems, we have implemented the required EU AI Act controls: technical documentation, human oversight measures, and registration with the relevant authority.