AI Governance Gap Analysis: Find Missing Owners and Checks

An AI governance gap is a difference between how AI is actually used and the responsibilities, rules, or checks your organization expects. Find it by tracing a real workflow, comparing evidence with the documented requirement, and assigning a person to resolve each difference. Tools like fenbs can retain the resulting human decisions and follow-up work, while the systems running AI provide the operational evidence.

1. Choose one workflow and its boundaries: who uses AI, which information enters it, and what happens to the output.
2. Gather both the written expectation and evidence of the current practice. Label missing evidence as unknown.
3. Compare the two for ownership, permitted use, access, review, and escalation. Write one specific finding for each difference.
4. Ask an authorized person to choose the response, name the implementation owner, and define the check that will show it worked.
5. Retest the changed workflow before closing the finding, then record what would trigger another review.

Where should you look first?

Start where an AI output changes somebody else’s experience: a customer reply, a proposed invoice, or a website update. Choose a workflow small enough to observe from input to final action. A list of purchased AI tools helps, but does not show what people do with them.

Say a design studio uses an assistant to draft project updates. Follow one example from the source notes to the message a client receives. Ask who checks factual claims, which information may be included, and whether a draft can be sent without that check. Keep private client material out of the review record; use references and sanitized examples.

The NIST Map playbook↗ (opens in a new tab) starts with understanding purpose, setting, users, and potential effects. Use that context to decide what your comparison must cover. For the wider collection of related questions, see the AI governance hub.

What counts as useful evidence?

A policy describes the expected behavior. Evidence shows what occurred or what a control currently permits. You need both. Ask a workflow owner to demonstrate an ordinary case and a case that should be refused, using test information rather than exposing confidential records.

Record the scope and date of each check. A successful test for one account does not establish that every account has the same settings. An interview is valuable evidence of what someone understands, but does not establish that a technical restriction works. If evidence cannot be obtained, preserve that limitation.

How do you separate different kinds of gap?

Separate an absent rule from an absent control. If nobody has chosen whether AI may send client messages, the next step is a human decision. If the rule already requires review but the send function bypasses it, the next step is an implementation change. Giving both findings the title “update policy” hides the important difference.

There can also be an ownership gap, where the task exists but nobody has authority to complete it, or an evidence gap, where a claimed check cannot be demonstrated. More than one can apply to the same workflow. Keep them connected without treating one fix as proof that all the others are resolved.

The NIST Govern playbook↗ (opens in a new tab) emphasizes clear responsibilities and communication. Record who chooses the response separately from who changes the system. Our guides to governance roles and small-team assistant governance address those nearby responsibilities.

Which findings should you resolve first?

Compare the consequence of failure, how readily it could occur, and whether someone can detect and reverse it. An assistant that can publish a customer message without review deserves earlier attention than an outdated description of an unused experiment. Describe your reasoning rather than relying on a score that conceals uncertainty.

For each finding, write the observed condition, the expected condition, the affected workflow, and the evidence reference. Add the proposed response and the person authorized to accept any remaining risk. If the evidence is incomplete and the possible consequence is serious, ask that person whether use should pause while the team investigates.

Do not quietly redefine the expectation to match existing practice. A person may decide that the old restriction is unnecessary, but that is a change requiring its own reason and authority. The guide to AI governance principles covers how broader commitments inform those choices.

What proves a finding is ready to close?

Define the closing check before work starts. “Approval added” is weaker than “a test message cannot be sent until the designated reviewer approves it.” Include the allowed case, the refused case, the tester, the result, and any limits. Keep the original finding so the team can see why the change happened.

A policy acknowledgment may close a communication gap, while a system change needs a system check. Where independence matters, have someone other than the implementer verify it. Repeat the comparison after a material workflow change; a new connection or broader permission can invalidate the earlier result.

A shared record helps preserve those distinctions between sessions, as explained in what an AI brain keeps. In fenbs, Decisions and rules and task history let the next assistant read the agreed response and the remaining check together.

How to do this with fenbs?

1. Create a free account and add a project for the workflow you are reviewing. A personal account is free for one person, no credit card.
2. Add a task for each gap. Describe the observed behavior, the written expectation, and the evidence reference without copying sensitive inputs.
3. Record the authorized person’s response in Decisions and rules. Keep unresolved choices open; an assistant can record a human decision but cannot make or sign it off.
4. Put the implementation and verification steps in each task’s plan. Update its testing result after the actual check, and save progress with the next step before stopping.

fenbs is useful for retaining the review’s decisions and work. It does not inspect AI accounts, block prohibited inputs, or certify compliance. Use specialist systems when you need automatic discovery or enforcement, and keep their evidence in the appropriate controlled location.

How do you keep the review from becoming paperwork?

Finish with a short list somebody can act on: what differs, why it matters, who chooses, who changes it, and what must be checked. Count unresolved findings by consequence and ownership, rather than celebrating how many documents were created. Review a sample of closed findings to see whether the evidence still supports them.

Ask a person who performs the work to try the revised process. If following it is confusing, capture that as another concrete finding. The practical starting examples in how to use AI at work can help you choose the next ordinary workflow to examine.