AI Governance Questionnaire for Reviewing Workplace AI Use

An AI governance questionnaire helps a team surface the decisions it has not yet made about AI use at work. The value is not in filling out a form—it is in finding the gaps: the tools nobody approved, the data nobody assessed, the review steps nobody assigned. fenbs lets teams record the answers as actual Decisions and rules, assign follow-up tasks, and make the agreed boundaries visible to every person and connected AI assistant.

This questionnaire is structured around four areas: data handling, ownership and approval, accountability, and access. Work through it as a team, not individually. The answers surface organizational assumptions that individuals may hold differently.

How to use this questionnaire

Read each question aloud with the relevant people in the room. When an answer is "we don't know" or "it depends on who you ask," that is a governance gap. Record the question, the discussion, and the decision you reach. Questions that remain open should become tasks, not just deferred answers.

After the session, convert each answer into a Decisions and rules entry: a clear statement, the name of the person who decided it, and the date. A conversational note is not a decision; a record with a named decider is.

Data and privacy questions

• Which AI tools are in use across the team, and has each one been reviewed for data handling?
• What categories of data are entering AI tools: internal documents, client information, personal data, financial records?
• Have team members been told which data categories are and are not permitted to enter AI tools?
• Are any AI tools processing personal data without a data processing agreement in place?
• Does the team know which AI tools send data to third-party servers for processing or model training?
• Is there a clear process for a team member to check whether a new AI tool is approved before using it?

If several of these questions produce uncertain answers, start with the approved tool list. A documented list of reviewed and approved AI tools—with the data categories each is permitted to handle—is the single highest-value governance artifact for most teams.

Ownership and approval questions

• Who is responsible for approving new AI tools before they are used by the team?
• Who is responsible for the accuracy and quality of AI-generated outputs used in the organization's work?
• Is there a named person who owns the team's AI policy, and when was it last reviewed?
• When an AI tool produces an unexpected or incorrect output, who decides how to respond?
• Have the people with these responsibilities accepted them explicitly, or are they assumed by default?

Governance ownership that is assumed rather than assigned will not hold under pressure. A named owner who knows they are responsible takes the role differently than someone who discovers they are responsible after something goes wrong.

Accountability and audit questions

• Is there a record of which AI tools were used to produce which outputs in the team's work?
• Are review steps—human checks before AI-generated outputs are used—documented in writing?
• When an AI output is approved for use, is there a record of who approved it and when?
• Has the team had any AI policy violations or unexpected incidents? Were they recorded and followed up?
• If a regulator or auditor asked to see the team's AI governance record today, what would you show them?

The last question is worth spending time on. A team with no answer, or an answer that consists of email threads and meeting notes scattered across different tools, has a record problem. The governance decision made in a meeting is only as good as the record of it.

Access and roles questions

• Which team members have access to which AI tools, and is access based on a defined role?
• Are AI assistants connected to your systems acting as themselves, or acting as a person with that person's level of access?
• Can any AI assistant take actions that require human approval without getting that approval first?
• When a team member leaves, is their AI tool access revoked in the same process as their other system access?

How to do this with fenbs

Run the questionnaire session and record results in fenbs in the same meeting, while the discussion is still live.

1. Create a free account and set up a governance project for the team. Give it a short description and add everyone who is part of the review.
2. As you work through each question, write answered questions as Decisions and rules. Include the answer, the name of the person who decided it, and any conditions or exceptions.
3. Create tasks for unanswered questions or identified gaps. Assign each task to a named owner with a target date.
4. After the session, review the decisions list together. Check that each decision is specific enough that a new team member—or an AI assistant—could follow it without asking for clarification.
5. Schedule a follow-up task at the review interval you decide: quarterly for most teams, monthly during a pilot. Reopen the questionnaire and check what has changed.

fenbs does not audit AI tool access, monitor usage, or connect to your identity management systems. It holds the governance layer: the decisions the team has made, the questions still open, and the record of who decided what. For a broader guide to governance structure, see AI agent governance for small teams.