Organization Prep Work:
Policies need to be reviewed, updated and shared to all employees:
AI Policy (often included in the Information Security Program),
Acceptable Use,
Vendor Governance
Vendor Due Diligence, especially any AI documentation, needs to be gathered from all vendors.
Trainings need to be developed and assigned:
Employee trainings for acceptable use
Information Security Officer/AI Governance leader training
Board of Directors
Employee List, including employee names and departments, needs to be updated in the Access Management module because these are assigned in the Use Cases.
AI Governance Module:
System Map - start with checking the box for "Uses AI" for any applicable system.
Governance Controls - answer your institution wide controls pertaining to AI Governance.
System Review and Use Cases - pick one system to start with evaluating and documenting the use cases.