The kits built for these gaps

A discovery pass for the AI nobody logged, and a triage for what it turns up.

The workbook this assessment's gate comes from. Seven domains, an owner column, and a verdict that fails on an unowned row whatever the score.

An acceptable-use policy you edit, not draft, with the approval step written in.

A structure for writing an impact assessment that names failure modes and residual risk instead of concluding there is none.

Model and system cards, which is where provenance and intended use get written down in a form somebody else can read.

What to retain, for how long, and how to retrieve one output later.

A scorecard for whether people are told when a decision was automated.

A register of AI vendors and the sub-processors behind them, and where the data goes.

A reporting route, and a drill so it has been exercised, not only written.

Role-appropriate AI training, and the record of who took it.