AI Compliance and Governance Readiness Checklist

Description

AI Compliance and Governance Readiness Checklist

73 actionable checkboxes for AI regulatory compliance, data privacy, and governance readiness.

This role-based checklist contains 73 ready-to-use checkboxes extracted from the LLM Production Readiness — Complete Checklist (v8 consolidated). It covers the regulatory, legal, and governance requirements that compliance officers, legal teams, and governance leaders need before deploying LLMs to production.

What’s Inside:

• 73 checkboxes across 3 domains: Compliance (58), Identity & Access Management (9), Agentic Controls (6)
• EU AI Act live obligations: risk tier classification (unacceptable/high-risk/limited/minimal), technical documentation, AI literacy training (Article 4, enforceable since Feb 2025), high-risk system registration, conformity assessment, human oversight mechanisms, AI-generated content labelling, and GPAI model disclosure obligations
• EU AI Act deployer obligations (Article 26): provider vs deployer role identification, instructions of use, human oversight personnel, input data quality, log retention (6 months), and worker notification requirements
• EU AI Act provider artifacts: Declaration of Conformity (Article 47), CE marking (Article 48), and EN 301 549 accessibility compliance
• EU AI Act serious incident reporting (Article 73): incident classification, market surveillance authority identification, and operationalised reporting timelines (10-day/2-day/15-day deadlines)
• Post-market monitoring system documentation (Article 72)
• GDPR & data privacy: DPIA, data minimisation, right-to-be-forgotten with cascading deletion, lawful basis documentation, cross-border transfer controls, provider API version deprecation tracking, and annual data processing agreement review
• User data transparency & training opt-out (OWASP LLM02:2025): privacy notice publication and meaningful opt-out mechanisms
• HIPAA: BAA execution, HIPAA-aligned tool restrictions, PHI detection and redaction, and complete audit trails (6-year minimum retention)
• SOC 2 Type II: scoping determination, LLM-specific control mapping to Trust Service Criteria (CC6/CC7/CC8/CC9), continuous evidence artefact collection, and annual penetration testing
• ISO 27001: ISMS risk assessment inclusion and vendor risk register maintenance
• NIST AI RMF: all four functions (Map, Measure, Manage, Govern), NIST AI 600-1 Generative AI Profile cross-referencing, and living risk register maintenance
• ISO/IEC 42001: certification assessment and governance structure mapping
• Audit & documentation: append-only audit logs, hash chain tamper detection, knowledge item provenance tracking, and quarterly compliance review scheduling
• Log retention & archive policy: explicit retention periods per regulation, tiered storage (hot/warm/cold), automatic PII scrubbing before archive, cryptographic log integrity, and quarterly retrieval testing
• Board & executive AI accountability: named C-suite ownership, AI acceptable use policy, AI-specific incident response playbook
• Model cards & system cards: production model documentation, deployed system documentation, and update currency requirements
• Identity & access management: centralised IAM integration (LDAP/AWS IAM/Azure AD), SSO (OAuth 2.0/SAML), MFA enforcement, role-based access control, row-level security in graph/vector databases, secrets management, API token rotation, privileged access log auditing, and credential scanning
• Agentic controls: behavioural constraint documentation, per-agent policy files, kill switch testing, credential rotation testing, outbound connection verification, and full recovery drills
• Interactive HTML with progress tracking — check off items as you complete them

Use Cases:

• EU AI Act compliance readiness and conformity assessment (August 2026 deadlines)
• GDPR, HIPAA, SOC 2, ISO 27001, and NIST AI RMF audit preparation for AI systems
• Board-level AI governance, acceptable use policy, and incident response playbook creation
• Identity and access management architecture for LLM infrastructure
• Agentic AI behavioural constraints, kill switch verification, and recovery drills
• Vendor risk management for third-party LLM API providers

Perfect For: Compliance officers, GRC teams, legal counsel, data protection officers, board members, CISOs, and governance leaders responsible for AI regulatory compliance and risk management.