{"data":{"slug":"ai-governance-policy-raci","title":"AI Governance Policy and RACI","type":"policy","formats":["docx","xlsx"],"topics":["governance","evidence"],"frameworks":["iso-42001","nist-ai-rmf","eu-ai-act"],"short":"The governance policy an AI management system needs, built from the recorded governance duties, with a RACI matrix over every recorded control.","covers":{"categories":["governance_accountability","quality_management"]},"version":6,"dataset_version":"ef1018b7a6a2","generated_at":"2026-11-12T05:14:17+00:00","citations":92,"downloads":16,"files":[{"format":"docx","filename":"ai-governance-policy-raci-v6.docx","bytes":20696,"url":"https://aipolicytracker.org/templates/ai-governance-policy-raci#download"},{"format":"xlsx","filename":"ai-governance-policy-raci-v6.xlsx","bytes":30882,"url":"https://aipolicytracker.org/templates/ai-governance-policy-raci#download"}],"url":"https://aipolicytracker.org/templates/ai-governance-policy-raci","inside":["Document: purpose, principles, roles, the governance duties on record and how each is met, review cycle","RACI sheet: every recorded control against eight roles, R/A/C/I dropdowns","Controls sheet: what each control is for and which duties it satisfies"],"legal_basis":["iso-42001","us-nist-ai-rmf","eu-ai-act"],"caveat":null,"covered_obligations":[{"slug":"australia-vaiss-accountability-and-risk-management","title":"Establish accountability processes and a risk-management process (guardrails 1 and 2)","policy":"australia-voluntary-ai-safety-standard","source_reference":"Guardrails 1 and 2","url":"https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management"},{"slug":"us-california-sb-53-whistleblower-protections","title":"Frontier developers must protect employees who report catastrophic-risk concerns","policy":"us-california-sb-53","source_reference":"Labor Code Section 1107 (as added by SB 53)","url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections"},{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","policy":"eu-ai-act","source_reference":"Article 17","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system"},{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","policy":"eu-ai-act","source_reference":"Article 26","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations"},{"slug":"eu-ai-act-art-16-provider-obligations","title":"Providers must meet the full set of provider duties for high-risk AI","policy":"eu-ai-act","source_reference":"Article 16","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations"},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","policy":"eu-ai-act","source_reference":"Article 21","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities"},{"slug":"eu-ai-act-art-22-authorised-representative","title":"Non-EU providers must appoint an EU authorised representative for high-risk AI","policy":"eu-ai-act","source_reference":"Article 22","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative"},{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","policy":"eu-ai-act","source_reference":"Article 25(1) and 25(2)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","policy":"eu-ai-act","source_reference":"Article 26(10)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"eu-ai-act-art-52-systemic-risk-notification","title":"Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold","policy":"eu-ai-act","source_reference":"Article 52(1)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification"},{"slug":"eu-ai-act-art-54-gpai-authorised-representative","title":"Non-EU providers of GPAI models must appoint an EU authorised representative","policy":"eu-ai-act","source_reference":"Article 54","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative"},{"slug":"india-ai-guidelines-principles-and-risk-based-governance","title":"Adopt the guiding principles and risk-based governance (voluntary)","policy":"india-ai-governance-guidelines","source_reference":"Guiding principles and recommendations sections","url":"https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance"},{"slug":"nepal-ai-policy-responsible-ai-principles","title":"Government bodies to promote ethical, responsible and inclusive AI (policy commitment)","policy":"nepal-national-ai-policy","source_reference":"Policy objectives and strategies (to be confirmed against the official text)","url":"https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles"},{"slug":"singapore-mgf-internal-governance","title":"Establish internal governance structures and measures for AI","policy":"singapore-model-ai-governance-framework","source_reference":"Second edition, Part on internal governance structures and measures","url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","title":"Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 34(1)","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation"},{"slug":"south-korea-ai-basic-act-art-36-domestic-representative","title":"Foreign AI business operators above the threshold must designate a domestic representative in Korea","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 36","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-36-domestic-representative"},{"slug":"uae-ai-strategy-ethics-and-governance-commitment","title":"Government commitment to AI ethics, governance and regulation (strategy objective)","policy":"uae-national-ai-strategy-2031","source_reference":"Strategy objectives on governance and ethics (reviewer to cite the section)","url":"https://aipolicytracker.org/obligations/uae-ai-strategy-ethics-and-governance-commitment"},{"slug":"uk-principles-fairness","title":"Use AI in ways that are fair and do not discriminate unlawfully","policy":"uk-ai-regulation-white-paper","source_reference":"Principle 3, Part 3","url":"https://aipolicytracker.org/obligations/uk-principles-fairness"},{"slug":"uk-principles-accountability-governance","title":"Establish accountability and governance for AI","policy":"uk-ai-regulation-white-paper","source_reference":"Principle 4, Part 3","url":"https://aipolicytracker.org/obligations/uk-principles-accountability-governance"},{"slug":"us-nist-ai-rmf-govern","title":"Establish AI governance policies, roles and accountability (Govern)","policy":"us-nist-ai-rmf","source_reference":"GOVERN function","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern"}],"versions":[{"version":6,"generated_at":"2026-11-12T05:14:17+00:00","dataset_version":"ef1018b7a6a2","changelog":"Dataset 4559f86f527b → ef1018b7a6a2.","stats":{"sheets":{"RACI":26,"Controls":26,"Governance duties":20},"blocks":132,"headings":26,"citations":92}},{"version":5,"generated_at":"2026-10-16T05:30:02+00:00","dataset_version":"4559f86f527b","changelog":"Dataset 1e8ea28a8a93 → 4559f86f527b.","stats":{"sheets":{"RACI":26,"Controls":26,"Governance duties":20},"blocks":132,"headings":26,"citations":92}},{"version":4,"generated_at":"2026-10-09T05:30:01+00:00","dataset_version":"1e8ea28a8a93","changelog":"Dataset 52bd836b1d6b → 1e8ea28a8a93.","stats":{"sheets":{"RACI":26,"Controls":26,"Governance duties":20},"blocks":132,"headings":26,"citations":92}},{"version":3,"generated_at":"2026-10-08T05:30:01+00:00","dataset_version":"52bd836b1d6b","changelog":"Dataset 3335c39da4b7 → 52bd836b1d6b.","stats":{"sheets":{"RACI":26,"Controls":26,"Governance duties":20},"blocks":132,"headings":26,"citations":92}},{"version":2,"generated_at":"2026-09-27T05:30:01+00:00","dataset_version":"3335c39da4b7","changelog":"Dataset 914895c3103e → 3335c39da4b7.","stats":{"sheets":{"RACI":26,"Controls":26,"Governance duties":20},"blocks":132,"headings":26,"citations":92}},{"version":1,"generated_at":"2026-09-26T13:05:20+00:00","dataset_version":"914895c3103e","changelog":"First version, built from dataset 914895c3103e.","stats":{"sheets":{"RACI":26,"Controls":26,"Governance duties":20},"blocks":132,"headings":26,"citations":92}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}