AI adoption rarely begins with a formal enterprise program. It often starts with an employee testing a writing assistant, a team summarizing approved notes, or a department exploring classification and retrieval. The activity can create useful learning, but it also creates an operating question: who knows which use cases exist, what information is involved, who owns the outcome, and what must happen when an output is wrong?<\/p>\n
The Pragy Responsible AI Starter Kit<\/a> is designed for this practical gap. It provides editable policies, registers, risk tools, human-review checklists, vendor questions, incident records, communication materials, training resources, and a 90-day roadmap. It is a starting layer for governance work, not a legal opinion, compliance certification, or substitute for specialist review.<\/p>\n When experimentation happens outside a visible intake process, leaders cannot reliably distinguish an approved productivity use from a higher-impact decision workflow. The same tool may be used with public information in one team and sensitive data in another. A clear use-case inventory gives the organization a place to record purpose, owner, users, data types, affected people, outputs, decisions, vendors, controls, and status.<\/p>\n Visibility should not become bureaucracy for its own sake. The aim is to create enough information for proportionate review. A low-impact drafting aid should not receive the same treatment as a system affecting employment, eligibility, health, safety, quality-critical records, or contractual decisions.<\/p>\n A policy can define intent, principles, prohibited behavior, responsibilities, and escalation expectations. It does not by itself create an intake route, assign reviewers, classify risk, record approval, verify outputs, monitor change, manage vendors, train users, or handle incidents. Those elements require repeatable records and routines.<\/p>\n Practical governance connects the policy to work: an acceptable-use guide for employees, an intake form for use cases, a register for approved systems, a risk screen, approval evidence, human-review requirements, change control, incident logging, communication, and periodic review. The documents matter because they support accountable behavior.<\/p>\n A simple inventory can begin with known use cases and approved tools. Record a clear purpose, business owner, technical owner where relevant, users, data boundaries, expected output, human decision points, known limitations, and current status. Do not collect sensitive case data merely to populate the register. High-level descriptions are usually sufficient for initial qualification.<\/p>\n The inventory also supports prioritization. Some ideas can be paused because ownership is missing. Others may proceed through a low-risk route with standard controls. Higher-impact uses can be escalated for privacy, legal, security, regulatory, quality, safety, accessibility, procurement, or other specialist review as appropriate.<\/p>\n A four-tier operating model helps separate low-impact productivity support from high-impact or prohibited uses. The tier is not a legal classification. It is a practical routing decision based on the use, data, affected people, reversibility, decision consequence, transparency, vendor, and ability to verify output.<\/p>\n Controls can increase with risk. Lower-impact uses may need approved tools, data boundaries, user verification, and basic registration. Moderate uses may add documented testing, named reviewers, monitoring, and change approval. High-impact uses may require specialist assessment, formal approval, stronger evidence, restricted access, detailed oversight, and an explicit pause route.<\/p>\n Employees need to know what information may be entered into which approved service. Labels such as public, internal, confidential, personal, regulated, and restricted should connect to real handling rules. If the organization has an existing information-classification scheme, the AI guidance should align with it rather than inventing a competing model.<\/p>\n Vendor review matters because data retention, model training, hosting location, access, subprocessors, logging, deletion, security, and contractual terms can change the operating risk. A vendor questionnaire helps structure questions, but qualified privacy, security, legal, procurement, or regulatory specialists must make decisions within their domains.<\/p>\n A reviewer must have authority, relevant knowledge, source access, time, and a clear standard. The review should check facts against approved sources, unsupported claims, sensitive data, applicable business rules, required edits, confidence limits, and the consequence of relying on the output. The reviewer must be able to reject, escalate, or use a manual fallback.<\/p>\n Human review is weaker when the person is expected to approve every output quickly, cannot inspect the basis, or assumes the system is usually correct. Governance should specify where review occurs, what evidence is retained, who makes the final decision, and what happens when the model or supporting service is unavailable.<\/p>\n Approval is not permanent. A vendor may update a model, introduce a new feature, change terms, modify data handling, or alter an integration. The organization may expand the user population, connect a new data source, or move from recommendation to decision support. These changes can require reassessment.<\/p>\n A change record links the proposed change to impact, testing, reviewers, approvals, communication, rollback, and monitoring. It helps avoid the common mistake of treating an approved pilot as approval for every future use.<\/p>\n People need a safe route to report inaccurate output, inappropriate data use, unexpected behavior, harmful impact, security concerns, vendor issues, or policy breaches. The process should identify the owner, severity, containment, evidence, notification route, corrective action, closure, and learning. Serious situations require the organization\u2019s established incident and specialist processes.<\/p>\n Governance should also track benefits responsibly. A benefit register can record the intended outcome, baseline, evidence source, limitations, owner, and review date without inventing savings. This supports better decisions about whether to continue, change, scale, or stop a use case.<\/p>\n In the first month, appoint an accountable sponsor and governance owner, confirm approved-tool and data boundaries, gather known use cases, and establish a temporary escalation route. In the second month, classify priority use cases, adapt the policy and procedures, confirm human-review expectations, and deliver role-based communication and training.<\/p>\n In the third month, test intake and review using representative non-sensitive examples, close ownership gaps, confirm vendor and specialist routes, establish monitoring, and hold the first governance review. The sequence should be adjusted to the organization\u2019s risk, existing controls, resources, and professional obligations.<\/p>\n The Starter Kit supports organizations ready to adapt the resources internally. The Guided Review adds a focused review of up to three governance artifacts and two use cases, a 90-minute virtual session, a prioritized gap summary, and a 30-day action plan. The Working Session supports up to twelve participants through a three-hour facilitated session, decisions on up to five use cases, ownership, risk tiers, boundaries, human review, escalation, and a 90-day roadmap.<\/p>\n Multi-country, regulated, safety-critical, quality-critical, sensitive-data, employee-decision, customer-eligibility, surveillance, biometric, cross-border, or large enterprise requirements need separate qualification and appropriate specialist review. The public packages do not promise compliance or replace legal, privacy, cybersecurity, regulatory, quality, accessibility, or employment advice.<\/p>\n The AI Operations Opportunity Map<\/a> helps identify and prioritize useful opportunities. The Workflow Intelligence Sprint<\/a> can redesign and pilot a bounded workflow. The AI-Enabled Operations Review System<\/a> can sustain measures, exceptions, decisions, and actions. The Starter Kit provides a reusable governance baseline across those pathways where AI is being considered or used.<\/p>\n Responsible AI becomes real when use is visible, owners are named, controls match the impact, reviewers can act, incidents have a route, and changes are reassessed. A policy remains important, but operating controls turn the policy into accountable practice.<\/p>\nInformal adoption creates an operating blind spot<\/h2>\n
Why a policy PDF is not an operating system<\/h2>\n
Make AI use visible before trying to control it<\/h2>\n
Use proportionate controls<\/h2>\n
Define data boundaries in plain language<\/h2>\n
Meaningful human review is more than a checkbox<\/h2>\n
Govern the vendor and the change<\/h2>\n
Record incidents, concerns, and benefits<\/h2>\n
A practical 90-day sequence<\/h2>\n
Starter Kit, Guided Review, or Working Session<\/h2>\n
Connect governance to the operating portfolio<\/h2>\n