Internal AI Governance Checklist
For internal team use — our responsible-AI operating rules. This complements the public AI Usage Policy. Review quarterly.
Transparency & Disclosure
- Public AI Usage & Governance Policy is published and linked in the footer.
- AI-generated content is visually labeled within the app (AI-Generated badge).
- Users are told AI output is a draft/recommendation, not a final decision.
Human Oversight
- No AI output is auto-acted-upon without a human reviewing it first.
- Staff verify AI insights, financial figures, and generated content before use.
- High-stakes outputs (plans, financial guidance) always get a human sign-off.
Data Protection
- Customer business data is isolated per company (Row-Level Security enforced).
- No private business data is used to train third-party foundation models.
- Data is encrypted in transit and at rest.
- A Data Processing Agreement (DPA) is in place for EU/sensitive customer data.
Acceptable Use & Risk
- Team agrees not to input data they are not authorized to share into AI features.
- AI is never used to generate deceptive, discriminatory, or unlawful content.
- Known limitations (hallucinations, not professional advice) are documented and communicated.
- A point of contact is assigned to review reported AI issues.
Internal document · Review quarterly
