Stage III · Governance Stand-Up · Day 32 of 90 Sample walkthrough

Build the policy scaffolding that makes every downstream agent defensible.

"This stage produces the AI Policy, the AI Committee charter, the model inventory, and the vendor register — the four documents a regulator will ask for first. Everything else rests on these."

Completion62%
Evidence Linked12/17 required
Stakeholders5active
Est. Days Remaining8days
EU AI Act ArticlesArt. 9 · 10 · 13
Complete

Draft AI Acceptable Use Policy

Organisation-wide policy covering permitted use cases, prohibited content, incident reporting.

AUP-v1.2.pdf · a3f7b2c board-minutes.pdf · 9e4d1aa
In progress · 2 questions left

Establish AI Committee charter

Define membership, decision rights, escalation path, meeting cadence for the cross-functional body.

charter-draft.docx · 7c2f019 Continue →
In progress · 8 vendors to classify

Seed vendor & model register

Catalogue every AI vendor touching your data with risk tier, DPA status, sub-processor chain.

vendor-list.xlsx · 4b19e8d 3 DPAs signed Continue →
Not started

Publish model inventory

Every model in production: owner, purpose, training data summary, last evaluation date, risk tier.

Begin step →
Blocked · awaiting Legal

Risk taxonomy & impact classification

Map EU AI Act risk categories (prohibited, high-risk, limited, minimal) onto your use-case portfolio.

Waiting: legal@sample-org.example
Not started

Define incident response runbook

Who gets paged when an agent misbehaves, what gets killed, how customers are notified, how we learn.

Begin step →
instance pwi_kl4m2n8q7xp3 last_write 2026-04-19 14:02:31 UTC audit_chain ✓ verified
Unlock the full 9-stage Corporate pathway
Upload evidence, track audit-chain hashes, and export a signed EU AI Act Article 9 pack. Included on Business plan.
Upgrade to Business — $49/mo
Stage III · Step 3 of 6 · Vendor & Model Register

Classify each vendor by data access and risk tier.

Question 14 of 22 · dimension: vendor_governance

For OpenAI Platform API, what is the contractual basis for processing customer data?

Attach the signed DPA or MSA as evidence. If none exists, select "no DPA" and this will appear as a high-risk gap in your remediation plan.

Signed DPA with zero-data-retention addendum
The vendor is contractually bound not to train on or retain our data.
Signed DPA, standard retention terms
DPA in place; vendor may retain logs for the period specified in their terms.
MSA only, no separate DPA
Master agreement covers data; no dedicated data-protection addendum.
Clickwrap only — no negotiated contract
We accept the vendor's online terms. High risk under Article 28 GDPR and EU AI Act Art. 12.
Saved · synced to audit chain at 14:02:31
Stage V · Use-Case Portfolio · idle

AI use cases, ranked for the data you actually have.

Scores combine expected business value, data readiness from your live connectors, shipping speed, and EU AI Act risk penalty. Re-ranks automatically as your pathway progresses.

Sign in and start a pathway to see your ranked use-case portfolio.
{# Live-fetched rankings are injected into #uc-list. Static fallback beneath it covers the unauthenticated / marketing view so the tab is never empty. #}
I

Shipment Exception Handler

Logistics Data Ready Limited-Risk 14 day pilot

Your Snowflake shipments and exceptions tables contain 18 months of high-quality labelled data. Low regulatory overhead. Revenue protection of est. USD 240–480k per year based on sector benchmark.

87/ 100
value data speed risk
Unlock →
II

SOP Compliance Q&A

Operations Data Ready Limited-Risk 10 day pilot

Your 340-page SOP library is already indexed in Confluence. A retrieval-grounded agent can cut supervisor time on shift-handover by ~35%. Low risk because outputs are advisory, not directive.

81/ 100
value data speed risk
Unlock →
III

Invoice Extraction + GL Coding

Finance Data Ready Limited-Risk 21 day pilot

~4,200 supplier invoices per month through your Nairobi AP team. A human-in-the-loop extractor can absorb 70–80% of the keying load. Requires review of vendor tax codes before production.

74/ 100
value data speed risk
Unlock →
IV

Support Ticket Triager

Customer Support Data Ready Limited-Risk 7 day pilot

Zendesk history classified to 92% agreement on a 500-case holdout. Fastest path to value — could ship within one sprint with existing eval harness.

71/ 100
value data speed risk
Unlock →
V

KYC Adverse Media Screener

FinServ High-Risk · EU AI Act 45 day pilot

High business value, but classified as high-risk under EU AI Act Annex III. Requires FRIA, human oversight design, and Article 14 documentation before pilot. Recommended only after Stage IV.

58/ 100
value data speed risk
Defer · see FRIA
segment — templates — status pending fetch
Free · 12-minute assessment · Branded PDF

Is your data AI-ready?
Most companies' isn't.

84% of data stacks fail the checks required to deploy AI safely. Find out where you stand across eight dimensions in twelve minutes — then get a board-ready report to share.

15questions across eight dimensions
12maverage completion time
0$free — no card required
Get the branded PDF
Finish the score, then sign up to receive a signed PDF report and your Corporate pathway seed.
Sign up — it's free
Dimension 2 of 8 · Data Lineage 03 / 15

Can you trace, for any dataset, where each field originated?

We're asking about lineage — not just documentation. If Legal called tomorrow about one column, could you answer?

Yes — automated lineage tool in place+5
Partially — documented for critical tables only+3
Tribal knowledge — people know, nothing written+1
No — we couldn't reliably answer+0
⏱ 4m 12s elapsed