AI Security Programme Charter Template (.docx)
Download the AI Security Programme Charter Template (.docx)
Purpose: Bring the programme together in one document that a governing body can approve. The wiki's material on governance, risk, controls, testing and regulation is spread over many pages; the charter records the decisions and links each one to the page that holds the detail.
Audience: Accountable executives, AI governance leads, CISOs, risk and compliance leads.
Before you rely on it: The example values in the charter (meeting frequencies, exception limits, response times, retention periods) are the wiki's illustrative defaults from AI Operating Defaults, not values from a standard or a law. Replace them with your own. This is not legal advice.
What is in the document
| Section | What it records | Built from |
|---|---|---|
| 1. Purpose and scope | What the programme covers and what it does not | AI Governance Operating Model, Predictive Model Monitoring and Adversarial ML |
| 2. Risk appetite and prohibited uses | Appetite statement, prohibited and always-high-risk categories | AI Risk Methodology |
| 3 to 4. Accountability and decision rights | Named roles and bodies, committee charters, one approver per decision | AI Governance Operating Model |
| 5 to 6. Policy and risk method | Policy, standards and control baseline adopted; scoring method and calibration | AI Policy, Standards and Acceptable Use, Control Tiers, AI Risk Methodology |
| 7. Operating defaults | Exception and acceptance limits, incident times, notification deadlines, thresholds, release stages, log retention | AI Operating Defaults |
| 8. Assurance | Test approach and required validation level, monitoring, audit, evidence | Test Case Library, AI Security Audit and Evidence Checklist |
| 9. Regulatory obligations | Jurisdictions, instruments, owners and verification status | Regulatory Verification Status |
| 10 to 13. Training, reporting, roadmap and approval | Role-based training, reports and metrics, milestones, approval and review | AI Governance Operating Model, Maturity Model and Roadmap |
How to use it
- Draft. The accountable executive's team fills in sections 1 and 3 to 13 from the linked pages.
- Decide the reserved items. The governing body approves the risk appetite and prohibited uses (section 2), the AI policy (section 5) and the decision rights for the items it keeps.
- Adopt the defaults. Agree each value in section 7, or replace it, and record who approved it.
- Review. Review the charter at least annually and after a material incident, and record the changes in section 13.
Licence and credit
The document is licensed under CC BY-SA 4.0, like the rest of the wiki. Suggested credit: "AI Security Programme Charter" by Nachiket Sathaye and Ankush Jain, AI Security Wiki, licensed under CC BY-SA 4.0. If you share an adapted version, say what you changed and release it under the same licence.