AI GOVERNANCE PROGRAM
AI governance every quarter: the gate, the calendar and the record it leaves.
What is approved, on what condition, who watches, and what happens when a system misbehaves: this program makes those decisions every quarter.
Three situations this engagement answers.
- The inventory has no owner, so the register is already wrong.
- AI requests outrun approvals, and past approvals went unrecorded.
- A counterparty or department expects a written, maintained program with an owner.
Every AI request enters one gate, through six answers.
- What the tool is
- Product, version; bought, built, or inside licensed software
- What decision it touches
- How close to a customer; whether a rule requires an explanation
- What data goes in
- Categories by name, up to nonpublic information
- Who the vendor is
- With subprocessors, and whether your third party program covers it
- Who can turn it off
- The role holding the switch, and how fast
- What it replaces
- A task, a control, a review step, or nothing
Requests missing an answer are not tiered. The tier sets the approver: the business owner for lower tiers, the forum for higher, where the compliance and information security officers can each refuse. The forum's job is effective challenge in the sense the model risk guidance uses: an objective, informed party with the authority to refuse, and a record showing that it did so when it should have.
Each is decided within a written service level.
- approve
- approve with conditions
- pilot
- restrict
- defer pending evidence
- escalate
- reject
- suspend
- retire
Every decision uses one of these nine words and records the rationale, the approver, the conditions, the expiration and the trigger for reassessment.
What arrives in each period.
| Deliverable | What it is | Period |
|---|---|---|
| Inventory Refresh | The AI Use Register brought current | Quarterly |
| Register Maintenance | Every register, due reviews closed, not carried | Quarterly |
| Intake Log | Each request's tier, decision, approver and conditions | Quarterly |
| AI Leadership Report | Approvals, refusals, monitoring, decisions needed | Quarterly |
| AI Policy review | The policy tested against the year, and amended | Annually |
| Tabletop | The failure path rehearsed on your scenario | Annually |
Approval is only the start. What gets asked for later is what happened after it.
We watch each use of AI as often as its risk tier sets:
- Outputs sampled against what was approved.
- Override and exception rates, the signal that moves first.
- Complaints and disputes about decisions it shaped.
- Drift in the input population.
- A fresh review on the tier's cadence, or the approval lapses.
- Vendor model changes, under the notice terms from a vendor review.
For each material question the monitoring plan states the outcome protected, method, evidence and source, population and context, baseline, uncertainty and limits, decision threshold, cadence, owner, trigger, response and next review date.
Revised interagency model risk management guidance, SR 26-2 and OCC Bulletin 2026-13
This monitoring is not model validation, and it is not the model risk framework the revised guidance describes.
- Reaches
- Banks the OCC, Federal Reserve and FDIC supervise. The agencies state it is most relevant above $30 billion in total assets and place generative and agentic AI outside it; smaller banks' models remain subject to governance appropriate to size and risk profile.
- Not
- Credit unions.
When AI fails, the path is already decided.
- The trigger. Set in advance: a wrong output reaching a customer, a decision nobody can explain, or output the vendor cannot account for.
- The off switch. A named role may use it without convening anyone.
- Issued outputs. How far back to review, who reads them, and what is done for each person affected.
- Notification. Whether a clock starts, and which, on the clock map.
- The record. What happened, who decided, what was restored and changed.
- The tabletop. Rehearsed yearly on your scenario, every role present.
Meaningful human review, recorded against eight facts.
A reviewer shown a recommendation with no basis can only ratify it. Each review records competence, information and explanation, time and workload, authority to override and stop, the fallback, reason logging, quality checks, and safeguards against automation bias and conflicts. The disagreement rate is watched: a review function that never disagrees has stopped being one.
This program is not built on a state AI statute.
It rests on what holds either way: vendor oversight, the security program, the board record, counterparty mandates and explainable decisions, as Colorado and the order show.
Colorado SB 26-189
- 2024
- Colorado passes an AI statute, SB 24-205.
- April 2026
- A federal court stays enforcement in a challenge brought by xAI and joined by the Department of Justice.
- 27 April 2026
- The stipulated order in xAI v. Weiser stays enforcement of the replacement statute as well.
- 14 May 2026
- SB 26-189 replaces it, keeping notice, adverse outcome disclosure, data correction, and human review and reconsideration, without the algorithmic discrimination duty.
- 1 January 2027
- SB 26-189 takes effect.
Not yet in effect. Enforcement of both statutes is stayed until fourteen days after the court rules on xAI's motion for a preliminary injunction.
Not insurers complying with Colorado insurance law on algorithms, which are deemed compliant.
Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence
- 11 December 2025
- Signed. It directs a Department of Justice task force to challenge state AI laws in court and the Federal Trade Commission to state when federal law preempts them, conditions certain broadband funding, and calls for a legislative recommendation to Congress.
- 20 March 2026
- The White House publishes that recommendation as a nonbinding framework.
It creates no obligation on a private institution and does not by itself displace any state statute; preemption is for Congress or a court. No federal preemption statute had been enacted when this page was last reviewed.
Federal agencies only.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
What it needs, and where this firm stops.
- An inventory, which the AI Governance Assessment builds if none exists.
- A governance forum that meets.
- An owner per registered use, and a role holding the off switch.
- Someone who signs the AI Leadership Report and takes it to your board.
Red Stick Solutions builds the governance, the documentation and the record. It performs no model validation and no statistical fairness testing. Approval and refusal stay with your people.
Before you sign.
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| Something urgent | We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began. |
| If it stops | You keep everything produced to that point, in the form it is in that day. |
The Assessment starts the year, and the program follows.
Tell us what AI you use, who approves it, and when the board last asked. The written shape states the notice either side gives.
- Unit
- A quarterly cycle against the calendar
- Fee
- For each quarterly cycle, in writing once the written shape of the work is agreed, before you sign.
- Term and hours
- The term and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.