Stage 1: Set up governance | ClearPath AI Governance

What this stage is for

Without clear decision rights, nobody is answerable when an AI system produces a bad outcome. This stage creates the authority, rules and people that every later stage relies on. Think of it in two layers: a governance charter (the 'what and why': purpose, scope, authority, meeting cadence, escalation) and an operating model (the 'how': workflows, roles and tooling).

Who is involved

Executive sponsor, AI governance lead, Legal, Privacy, Security, HR.

Key outputs: AI policy, governance charter, RACI, training plan.

Step-by-step tasks

Tick each task as you complete it. Your ticks stay in this browser tab unless you export your workspace.

Name one accountable AI governance lead.
Write a short AI use policy and get it approved.
Form a governance group and write its terms of reference (purpose, members, quorum, how often it meets, how issues are escalated).
Agree who is Responsible, Accountable, Consulted and Informed for the main AI activities, with exactly one Accountable per activity.
Publish an acceptable use policy for staff who use general AI tools.
Set up AI training for everyone, starting with the Everyone learning path.

Region callouts

Shown for the regions in My regions (header). The region pages are never hidden.

The EU AI Act expects staff to have AI literacy and expects providers of high-risk systems to run a quality management system. The AI literacy wording was touched by the Digital Omnibus, so check the current text. European Union page

No federal AI statute sets a governance program, but the NIST AI RMF 'Govern' function is the common backbone, and customers and regulators often ask about alignment. United States page

The UK's five principles include accountability and governance. Regulators expect named responsibility for AI use in your sector. United Kingdom page

The India AI Governance Guidelines are voluntary but a useful base for your policy's principles. India page

Tools and templates

Tools

Start here planner: Six answers become a 30/60/90-day plan.
Policy builder: Assemble a policy from reviewed clauses.
RACI builder: Agree who does what.
Learning paths and training tracker: Paths, quizzes and a training plan table.
NIST AI RMF explorer and self-assessment: Explore and score against the four functions.
ISO/IEC 42001 gap analysis and SoA builder: Clauses 4 to 10 and Annex A by reference number.

Templates

"AI at work" quick reference card: MD, DOCX, DOCX, EU edition, DOCX, US edition, DOCX, UK edition, DOCX, India edition
AI change management and rollout plan: MD, DOCX
AI ethics review board charter: MD, DOCX
AI governance charter: MD, DOCX
AI meeting assistant and note-taker policy: MD, DOCX
AI tools onboarding guide for new staff: MD, DOCX
AI use policy: MD, DOCX
Data classification guide for AI tool use: MD, DOCX
Employee acceptable use policy for AI tools: MD, DOCX, DOCX, EU edition, DOCX, US edition, DOCX, UK edition, DOCX, India edition
ISO/IEC 42001 gap analysis (clauses 4 to 10, references only): XLSX, CSV, DOCX
ISO/IEC 42001 statement of applicability (Annex A by reference number): XLSX, CSV, DOCX
NIST AI RMF gap analysis (functions and categories): XLSX, CSV, DOCX
RACI matrix: XLSX, CSV, DOCX
Staff AI awareness training deck with speaker notes: MD, DOCX
Training plan and attendance record: XLSX, CSV, DOCX
All templates for every stage

Common mistakes

Writing a long policy no one reads, instead of a short one people follow.
Naming a committee but no single accountable person.
Treating the policy as a one-off document with no review date.

You're done when…

A policy is approved and shared with staff.
One accountable lead is named.
A governance group meets on a set schedule.
Roles are written down in a RACI.

Reviewed 3 Oct 2026.

Stage 2: Inventory and intake →