AI Data Governance and Privacy Checklist

This checklist assesses the organization's data governance practices, privacy controls, and data management throughout the AI lifecycle based on ISO 42001, CIS Controls, and NIST CSF frameworks.

Assessment Information

Organization Name:		Assessment Date:
Assessor Name:		Assessment Type:	Pre-Engagement / Post-Engagement

Compliance Status Legend

Status	Description
Compliant	The organization fully meets the requirements of the control.
Partially Compliant	The organization partially meets the requirements of the control.
Non-Compliant	The organization does not meet the requirements of the control.
Not Applicable	The control is not applicable to the organization's environment.

AI Data Governance and Privacy Controls

2.1 AI Data Governance Framework

Control ID	Control Description	Compliance Status	Evidence	Remediation
DATA-2.1	The organization has established a data governance framework specific to AI training and operational data, including policies, procedures, and oversight mechanisms.			Develop and implement an AI-specific data governance framework that addresses data quality, privacy, and security throughout the AI lifecycle. Establish data governance roles and responsibilities, including data stewards for AI datasets.

2.2 Bias Assessment and Mitigation

Control ID	Control Description	Compliance Status	Evidence	Remediation
DATA-2.2	The organization has implemented processes to identify, measure, and mitigate bias in AI training data to ensure fair and equitable AI system outputs.			Implement formal processes for bias assessment in training data, including diverse data sampling, statistical analysis, and regular bias audits. Develop bias mitigation strategies and document their effectiveness.

2.3 Data Lineage and Provenance

Control ID	Control Description	Compliance Status	Evidence	Remediation
DATA-2.3	The organization has established systems and processes for tracking data lineage and provenance throughout the AI lifecycle.			Establish data lineage and provenance tracking systems that document the origin, transformations, and usage of all AI-related data. Implement metadata management practices and tools to support data lineage tracking.

2.4 AI Data Protection Controls

Control ID	Control Description	Compliance Status	Evidence	Remediation
DATA-2.4	The organization has implemented data protection controls specific to AI training datasets and model outputs, including access controls, encryption, and data minimization.			Implement enhanced data protection controls for AI datasets, including encryption, access controls, and data minimization techniques. Develop and enforce data classification policies specific to AI training and operational data.

2.5 Data Retention and Disposal

Control ID	Control Description	Compliance Status	Evidence	Remediation
DATA-2.5	The organization has established data retention and disposal policies and procedures specific to AI training data.			Develop and implement a data retention and disposal policy specific to AI training data that complies with relevant regulations and minimizes risk. Establish secure data disposal procedures for AI datasets and document their implementation.

2.6 Data Quality Assessment

Control ID	Control Description	Compliance Status	Evidence	Remediation
DATA-2.6	The organization has implemented processes for regular data quality evaluation for AI systems, including completeness, accuracy, and relevance checks.			Establish formal data quality assessment processes for AI systems, including completeness, accuracy, and relevance checks. Implement data quality metrics and regular monitoring procedures for AI training and operational data.

Assessment Summary

Total Controls	Compliant	Partially Compliant	Non-Compliant	Not Applicable	Compliance Score
6	0	0	0	0	0%

Recommendations

Approval

Assessor Signature:		Date:
Client Signature:		Date: