Resources

What belongs in an AI inventory, how to run the first one without driving adoption underground, and how to keep it true once the initial sweep is over.

How to run an AI risk assessment: assess use cases rather than systems, ten dimensions, a three-tier model, and who is entitled to accept what remains.

What to ask an AI supplier, what to look for in the agreement, and how to review AI capability that arrived inside software you already own.

Fifty-seven checkable statements across fifteen areas, answered yes or no, to establish where an AI governance program actually stands and what to do first.

What the NIST AI Risk Management Framework is, its four functions, the Generative AI Profile, what it is not, and how to use it without adopting it wholesale.

Voluntary risk guidance versus a certifiable management system. What each instrument is for, how they work together, and language that stays accurate.

Prompts, retrieved context, embeddings, logs and outputs are data your privacy program probably does not map. What to rule on first, and where the data goes.

What generative AI adds to a governance program: confabulation, disclosure, intellectual property, prompt injection, and separate approval for the ability to act.

The twelve decisions an AI acceptable use policy has to make, why it should be a page, and the two sentences that do more work than the rest of the document.

Governing AI in a school district: the inventory, a data rule about student information, approved tools, student use, vendors and what to tell families.