What it is
Governing AI starts with a list of where it is used. The register records each use case, the tool, owner and data class, scores the risk before and after controls, and tracks approval and review.
A second tab organizes governance prompts under the four functions of the NIST AI Risk Management Framework: Govern, Map, Measure and Manage. Flags catch confidential data with no human review, high residual risk with no approval and overdue reviews.
When to use it
- Setting up AI governance in the firm.
- Quarterly review of AI use.
- Answering client questions on AI controls.
What’s inside
- 40 use case rows with inherent and residual scoring
- Main risk category and controls
- Approval and next review columns with flags
- RMF prompts tab and summary
Standard cited
This template follows NIST AI RMF 1.0. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What is the NIST AI RMF?
A voluntary framework from NIST with four functions: Govern, Map, Measure and Manage. The prompts tab is the firm’s own summary of what each is about.
What risk categories are used?
Confidentiality, accuracy, bias, security, legal and regulatory, explainability and over-reliance.
What triggers a flag?
Confidential or restricted data without human review, a high residual rating with no approval, and a review date in the past.
Related templates
- AI Acceptable Use Policy for CPA Firms
- AI Output Review Log (Excel)
- AI Tool Approval Request Form
- Risk Register
Last updated 11/05/2026. All free templates.