AI governance that doesn't paralyse
The lightest defensible set of measures for each kind of use
Free · worksheet · 10 pagesTwenty minutes per use case
For each AI use case you can show which measures are needed and which aren't, so governance stops being a reason to do nothing.
The document is in Dutch.
Why you won't find this anywhere else
Most governance content sells the maximum set of measures, because that is safer for whoever writes it. The result is paralysis: everything is treated as high risk and nothing goes live. This worksheet does the opposite, which makes it debatable: it points to the lightest set you can explain to an auditor or a security officer. Written by an organisation that is itself ISO 27001 certified, so the lower bound is not optional.
What's inside
- Four questions that classify a use case, with a decision tree into three categories
- For each category the full set of measures: what you record, who signs, what you log, and what you explicitly don't do
- Where the requirements you already have come from: the GDPR, your customer contracts and your own security agreements, and what vendors add on top
- A six-column register that stays usable instead of turning into an archive
- Where this stops and a lawyer takes over, stated explicitly
Who it's for
- Technical and digital leads who want AI live without working around governance
- Organisations with a security officer looking over their shoulder
- Teams where every use case is treated as high risk by default
Not for anyone looking for a legal opinion. This is an operational and technical classification.
What this document doesn't solve
You can classify and justify. You don't have a legal opinion, and no view of which of your use cases carries the most technical risk.
That's what the AI Opportunity Audit is for: we map your processes, show where AI and automation deliver the most, and set out what to do first.
See the AI Opportunity Audit