We hold one written list of every AI tool used anywhere in the business, including tools individual staff signed up for themselves.

The list records who uses each tool, what for, and who approved it.

We know which of our own systems, spreadsheets and customer records each tool connects to or reads from.

Somebody checks the list at least every quarter, and new tools cannot be bought on a company card without being added to it.

We have decided, tool by tool, which categories of client and staff data may be entered into it, and staff know the rule.

We have a short AI use policy, under two pages, that staff have read and signed, and it says what happens if the rule is broken.

We have read each vendor's terms and know whether our data is used to train their models, where it is stored and for how long.

When a person leaves, their access to every AI tool is removed on the day, and we can show the record.

We can hand an outsider one page that lists our AI tools, the data each may touch and the controls around them.

Where AI output influences a decision that affects a client, a price or a person, we keep a record of the human who reviewed it.

We have answered an AI or data questionnaire from a customer, insurer or lender in the last twelve months without scrambling.

Our controls are laid out so that an auditor working to ISO/IEC 42001, the international standard for managing AI, would recognise them, even if we have no plan to certify.

We can name the software, datasets, models, prompts and customer lists the business depends on, and say who legally owns each one.

Contracts with developers, contractors and AI vendors make clear that the intellectual property belongs to the company.

The code, data and documentation are kept in a place the company controls, are backed up and could be handed to a buyer's technical reviewer.

We have had these assets valued, or we know on what basis a valuer would do it and what evidence they would ask for.

Every figure an AI tool produces for the bank, the board or a client, including cash forecasts, is checked by a person who could explain it.

We log AI errors and near misses, and we have changed at least one process because of something we logged.

If our most-used AI tool disappeared tomorrow, we know what would stop, who would be affected and how we would carry on.

We know which of our uses fall under the EU AI Act or UK guidance, what that requires of us and by when.